feat(infra): observability backplane — Tempo + Prometheus + Grafana (S-16a, closes #122) (#125)

## What & why

S-16a, the first of the **S-16 split** (#17 closed → #122/#123/#124, §13). Stands up a local, CI-friendly observability backplane so traces (S-16b) and metrics (S-16c) have somewhere to land, viewable in one Grafana.

- **Grafana Tempo** — OTLP trace ingest (gRPC 4317 / HTTP 4318), local storage.
- **Prometheus** — scrapes itself for now; service `/metrics` targets arrive in S-16c.
- **Grafana** — Tempo + Prometheus datasources auto-provisioned with fixed uids (`tempo`, `prometheus`), exposed on :3000.

All three are small **built images** with config baked in (`infra/observability/`), on the existing `cg` network. **No OTLP collector** (Tempo ingests OTLP directly; Prometheus scrapes) and **no config-volume seeding** — the tools aren't verbatim CG peer modules, so a 3-line `COPY` Dockerfile is the simpler path that still reaches sibling containers on the CI runner (**ADR-0023**).

### Verified, not assumed

`make verify-observability` (new CI `verify-stack` step, run early) asks Grafana to reach both datasources — Prometheus via its health method, Tempo via the datasource proxy (Tempo's plugin implements no health method) — so it proves the datasources are wired, not merely that containers booted. Validated locally against the three containers (no external egress): Grafana healthy, both datasources reachable.

Closes #122

## Definition of Done

- [x] Failing test committed first (`verify-observability` fails with no backplane).
- [x] Implementation makes it pass; verified locally.
- [x] Conventional Commits referencing the issue (`refs #122`).
- [ ] CI green — awaiting Gitea Actions (verify-stack now includes the observability step; `docker compose config` validates locally).
- [ ] `docker compose up` reaches green health within 3 min — new containers are lightweight and off the health-gate list.
- [x] Docs — ADR-0023, demo-script, BACKLOG sync.
- [x] ADR added — `docs/architecture/adr-0023-observability-stack.md`.
- [x] Demo note in `docs/demo-script.md`.

## Notes for reviewers

- **No app changes** — this is pure infra; the five services are untouched (instrumentation is #123/#124).
- **Ports:** Grafana 3000 (admin/admin, anonymous viewer on), Prometheus 9090; Tempo internal to `cg`.
- **CI:** the three containers are added to the failure log-dump list; deliberately **not** added to `WAIT_SVCS` (the check polls Grafana itself, so no in-image healthcheck tool is needed). Trades ~3 small image builds per run.
- **Next:** #123 wires OTLP export + `AddAspNetCoreInstrumentation`/`AddHttpClientInstrumentation` into the five hosts so a request becomes one connected trace in Tempo.

Reviewed-on: #125

docs/demo-script.md

@@ -5,6 +5,31 @@ copy-pasteable walkthrough against a local `make up` stack.
 
 ---
 
+## S-16a — observability backplane: Tempo + Prometheus + Grafana (#122, ADR-0023)
+
+**Outcome:** the compose stack now includes a Grafana-native observability backplane — **Tempo** (OTLP
+trace ingest on 4317/4318), **Prometheus**, and **Grafana** with both datasources auto-provisioned.
+Nothing is instrumented yet (traces land in S-16b, metrics + dashboards in S-16c); this slice stands the
+backplane up and proves Grafana can reach both datasources. Config is baked into small built images
+(`infra/observability/`) — no collector, no config-volume seeding.
+
+```bash
+# 1. Bring the stack up, then assert the backplane is live (Grafana healthy + Tempo/Prometheus
+#    datasources reachable through Grafana). This is a CI verify-stack step.
+make up
+make verify-observability        # → ✓ Grafana healthy  ✓ Prometheus reachable  ✓ Tempo reachable
+
+# 2. Or just the backplane, no full stack needed (no external egress):
+docker compose -f infra/docker-compose.yml up -d --build tempo prometheus grafana
+open http://localhost:3000        # Grafana (admin/admin) → Connections → Data sources: Prometheus + Tempo
+open http://localhost:9090        # Prometheus
+```
+
+**The path:** services will export OTLP → **Tempo:4317** and expose `/metrics` ← **Prometheus** scrapes;
+**Grafana** (:3000) reads both via provisioned datasources with fixed uids `tempo` / `prometheus`.
+
+---
+
 ## S-17 — herregistratie reminder sweep on a Quartz cron (#18, ADR-0022)
 
 **Outcome:** an inscription (INGESCHREVEN) now carries the moment it was entered in the register, from