Description

• Add counters/histograms for scope-allowed vs scope-denied requests, and allow-list misses.
• Tag metrics with scope names (cardinality guarded) and resource types.

Key files/areas

• Server metrics package; middleware instrumentation.

Acceptance criteria

• Dashboards or logs show scope-related enforcement outcomes.