feat(server): add observability and operator controls (#16)

docs/security/abuse-protection.md

@@ -20,6 +20,10 @@ traffic is also isolated by its authenticated scope.
    Health probes use their own source-prefix budget so public API overload cannot
    make a healthy instance fail its orchestrator probes, while health traffic is
    still bounded.
+   Operator endpoints likewise use a separate bounded rate/concurrency partition
+   backed by the critical tracker reserve. They first require an exact source IP
+   from the default-deny `OperatorAllowedAddresses` policy, so public traffic
+   cannot spend the incident-response budget.
 3. Once an endpoint has safely derived identities, it also acquires applicable
    tenant, principal or capability, and listing/attempt budgets. Secret
    capabilities are represented only by bounded SHA-256 fingerprints.
@@ -41,7 +45,8 @@ load shedding.
 
 `Rendezvous:AbuseProtection:MaxTrackedKeys` is a hard combined ceiling for rate
 and active-concurrency keys. General HTTP and UDP traffic cannot consume the
-configured `CriticalTrackedKeyReserve`; lease operations and health probes may
+configured `CriticalTrackedKeyReserve`; lease operations, health probes, and
+allowlisted operator controls may
 use that reserve but never exceed the hard ceiling. A request that would exceed
 its applicable ceiling fails closed without adding state. Fixed-window rate keys
 are cleared at the next window boundary; concurrency keys are removed as their