feat: add Prometheus metrics endpoint and Docker image (PLAN.md 4.2)

Add internal/metrics package with dedicated Prometheus registry exposing
SSH connection, auth attempt, session, and build info metrics. Wire into
SSH server (4 instrumentation points) and web server (/metrics endpoint).
Add dockerImage output to flake.nix via dockerTools.buildLayeredImage.
Bump version to 0.7.0.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/config/config.go

@@ -21,8 +21,9 @@ type Config struct {
 }
 
 type WebConfig struct {
-	Enabled    bool   `toml:"enabled"`
-	ListenAddr string `toml:"listen_addr"`
+	Enabled        bool  `toml:"enabled"`
+	ListenAddr     string `toml:"listen_addr"`
+	MetricsEnabled *bool `toml:"metrics_enabled"`
 }
 
 type ShellConfig struct {
@@ -143,6 +144,10 @@ func applyDefaults(cfg *Config) {
 	if cfg.Web.ListenAddr == "" {
 		cfg.Web.ListenAddr = ":8080"
 	}
+	if cfg.Web.MetricsEnabled == nil {
+		t := true
+		cfg.Web.MetricsEnabled = &t
+	}
 	if cfg.Shell.Hostname == "" {
 		cfg.Shell.Hostname = "ubuntu-server"
 	}