feat: Phase 2 — request tracing & persistence (OpenTelemetry + SQLite)

[MANVENDRA-github]

What

ROADMAP Phase 2 — tracing & persistence (PRP C7). Every request becomes an OpenTelemetry span — provider, model, status, latency, token usage — persisted to a queryable store and exposed through an admin-gated read API.

• OpenTelemetry SDK — one span per request via a route onRequest hook; a custom TraceStoreSpanExporter persists finished spans to the trace store; optional OTLP/HTTP export to Jaeger/a collector when OTEL_EXPORTER_OTLP_ENDPOINT is set. The tracer is resolved lazily per request so it binds to the registered provider (not a no-op captured at import).
• Trace store — a TraceStore interface with SQLite (better-sqlite3) and in-memory backends behind a createTraceStore factory. Streaming and the hijacked SSE path are traced inline (no onResponse after hijack); the span ends exactly once.
• Read API — GET /traces (+ /traces/:id) gated by a dedicated SENTINEL_ADMIN_KEY, distinct from client keys. Filters: model, provider, status, stream, since, until, limit (≤500), offset.
• Privacy — metadata only; no prompt/response bodies are stored, and API keys are recorded as a SHA-256 hash, never raw. (SECURITY_REVIEW_LOG SR-002.)

How to verify

pnpm install
pnpm verify     # typecheck + lint + 69 tests, 93% branch coverage

Live smoke test

Ran the full path in-process against a real SQLite store + the real OTel bootstrap (initTelemetry):

• completion -> 200
• GET /traces with the admin key -> 200, returning the persisted trace: model, provider, durationMs, token usage (8/4/12), and apiKeyHash (a sha256, not the raw key)
• GET /traces without the admin key -> 401

Notes

• better-sqlite3 pinned to v11 (v12 had no prebuilt binary for the local Node 20 / Windows setup; v11 ships one and also covers CI's Linux/Node 22). Added to pnpm.onlyBuiltDependencies. Falls back to the in-memory store if the native module is ever unavailable.
• Streaming token usage stays null unless the client sends stream_options.include_usage (deferred). Per-key trace scoping deferred — admin-only for now.
• Next: Phase 3 (semantic cache).