feat: capture SSH exec commands (PLAN.md 4.4)

Bots often send commands via `ssh user@host <command>` (exec request)
rather than requesting an interactive shell. These were previously
rejected silently. Now exec commands are captured, stored on the session
record, and displayed in the web UI session detail page.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/metrics/metrics.go

@@ -23,6 +23,7 @@ type Metrics struct {
 	SessionsTotal          *prometheus.CounterVec
 	SessionsActive         prometheus.Gauge
 	SessionDuration        prometheus.Histogram
+	ExecCommandsTotal      prometheus.Counter
 	BuildInfo              *prometheus.GaugeVec
 }
 
@@ -70,6 +71,10 @@ func New(version string) *Metrics {
 			Help:    "Session duration in seconds.",
 			Buckets: []float64{1, 5, 10, 30, 60, 120, 300, 600, 1800, 3600},
 		}),
+		ExecCommandsTotal: prometheus.NewCounter(prometheus.CounterOpts{
+			Name: "oubliette_exec_commands_total",
+			Help: "Total SSH exec commands received.",
+		}),
 		BuildInfo: prometheus.NewGaugeVec(prometheus.GaugeOpts{
 			Name: "oubliette_build_info",
 			Help: "Build information. Always 1.",
@@ -88,6 +93,7 @@ func New(version string) *Metrics {
 		m.SessionsTotal,
 		m.SessionsActive,
 		m.SessionDuration,
+		m.ExecCommandsTotal,
 		m.BuildInfo,
 	)