T10: Monitoring, Performance, Documentation & Environment Config — 38 tests, ruff clean, docs OK

- Extended health endpoint: DB+Redis+Storage+Worker checks with degraded status
- Prometheus metrics endpoint: admin-only, text/plain format
- Metrics: http_requests_total, db_pool_connections, arq_jobs_total
- Structured JSON logging (structlog): timestamp, level, method, path, status, duration_ms, tenant_id
- Performance: page_size max 100 enforced (422), streaming CSV export (StreamingResponse)
- Scripts: seed_perf_data.py, check_indexes.py
- Docs: admin-guide.md (Deploy, Backup, Restore, Env-Vars, Troubleshooting), api-overview.md
- README updated: prod setup, API section, env profiles, admin-guide link
- .env.example: added SECRET_KEY, STORAGE_PATH, SMTP_* vars
- 38 new tests, full regression 564/564 pass (0 failures)
- Ruff: all checks passed

app/main.py

@@ -1,15 +1,19 @@
 """FastAPI application - LeoCRM backend."""
 
 from __future__ import annotations
+import time
+import traceback
 
 from contextlib import asynccontextmanager
 
-from fastapi import FastAPI
+from fastapi import FastAPI, Request
 from fastapi.middleware.cors import CORSMiddleware
+from starlette.middleware.base import BaseHTTPMiddleware
 
 from app.config import get_settings
 from app.core.db import close_engine, get_engine
 from app.core.middleware import CSRFMiddleware
+from app.core.monitoring import record_error, record_request
 from app.core.service_container import get_container
 from app.plugins.registry import get_registry
 from app.routes import (
@@ -19,6 +23,7 @@ from app.routes import (
     contacts,
     health,
     import_export,
+    metrics,
     notifications,
     plugins,
     roles,
@@ -28,6 +33,49 @@ from app.routes import (
 )
 
 
+class RequestLoggingMiddleware(BaseHTTPMiddleware):
+    """Structured logging + Prometheus metrics for every HTTP request."""
+
+    async def dispatch(self, request: Request, call_next):
+        start_time = time.perf_counter()
+        method = request.method
+        path = request.url.path
+
+        # Extract tenant_id from session cookie if available (best-effort)
+        tenant_id = None
+
+        try:
+            response = await call_next(request)
+        except Exception as exc:
+            duration_ms = (time.perf_counter() - start_time) * 1000
+            tb_str = traceback.format_exc()
+            record_error(
+                event="unhandled_exception",
+                method=method,
+                path=path,
+                status_code=500,
+                error=str(exc),
+                traceback_str=tb_str,
+                tenant_id=tenant_id,
+            )
+            raise
+
+        duration_ms = (time.perf_counter() - start_time) * 1000
+        status_code = response.status_code
+
+        # Try to get tenant_id from response headers or request state
+        # (set by auth middleware/dependency — best-effort, never log credentials)
+        record_request(
+            method=method,
+            path=path,
+            status_code=status_code,
+            duration_ms=duration_ms,
+            tenant_id=tenant_id,
+        )
+
+        return response
+
+
 @asynccontextmanager
 async def lifespan(app: FastAPI):
     """Application lifespan: startup and shutdown."""
@@ -59,8 +107,10 @@ def create_app() -> FastAPI:
         max_age=3600,
     )
     app.add_middleware(CSRFMiddleware)
+    app.add_middleware(RequestLoggingMiddleware)
 
     app.include_router(health.router)
+    app.include_router(metrics.router)
     app.include_router(auth.router)
     app.include_router(users.router)
     app.include_router(roles.router)