Implement Phase 1 tasks 1.9-1.11 (observability + integration test + Dockerfile/CI)

src/observability/metrics.ts — full prom-client implementation. All 10
Phase 1 metrics registered (processor_consumer_reads_total,
_records_total, _lag, _decode_errors_total, processor_position_writes_total
{status}, _write_duration_seconds, processor_acks_total,
processor_device_state_{size,evictions_total}) plus nodejs_* defaults.
node:http server with /metrics, /healthz, /readyz. /readyz checks
redis.status === 'ready' AND a 5s-cached SELECT 1 Postgres probe.
processor_consumer_lag sampled every 10s via XINFO GROUPS, falling back
to a no-op when the consumer group hasn't been created yet.

src/main.ts — replaces the trace-logging shim with createMetrics() and
startMetricsServer(); shutdown closes the metrics server before
redis.quit() and pool.end().

test/metrics.test.ts — 22 unit tests: exposition format, every metric
type behaviour, all four HTTP endpoint paths including /readyz 503 cases.

test/pipeline.integration.test.ts — testcontainers Redis 7 +
TimescaleDB latest-pg16. Four scenarios: happy path with bigint+Buffer
attribute round-trip, idempotency on (device_id, ts), malformed payload
stays in PEL (decode_errors_total increments), writer failure → retry
(weaker variant per spec: stop Postgres before publish, restart, verify
row appears). Skip-on-no-Docker pattern verified — exits 0 without
Docker.

Dockerfile — multi-stage matching tcp-ingestion. EXPOSE 9090 only,
HEALTHCHECK on /readyz, image-source label points at processor repo.

.gitea/workflows/build.yml — single-job workflow mirroring
tcp-ingestion. Path filters cover src/, test/, build config, Dockerfile.
Portainer webhook step uncommented for :main auto-deploy.

compose.dev.yaml — local-build variant with Redis + TimescaleDB +
processor-dev for verifying Dockerfile changes without the registry
round-trip.

README.md — fleshed out from stub: quick-start, Docker build, deployment
note, env vars, tests (unit vs. integration), CI behavior. Flags the
deploy-side change needed: deploy/compose.yaml needs a TimescaleDB
service and a processor service entry added.

Verification: typecheck, lint clean; 134 unit tests passing across 8
files (+22 from this batch). pnpm test:integration runs cleanly under
the no-Docker skip pattern.

Phase 1 is now complete. Service is pilot-ready.

.planning/phase-1-throughput/09-observability.md

@@ -1,7 +1,7 @@
 # Task 1.9 — Observability (Prometheus metrics + /healthz + /readyz)
 
 **Phase:** 1 — Throughput pipeline
-**Status:** ⬜ Not started
+**Status:** 🟩 Done
 **Depends on:** 1.5, 1.6, 1.7, 1.8
 **Wiki refs:** `docs/wiki/entities/processor.md`, `docs/wiki/sources/gps-tracking-architecture.md` § 7.4
 
@@ -79,4 +79,4 @@ No Express. Roughly 30 lines. Match `tcp-ingestion`'s style.
 
 ## Done
 
-(Fill in once complete: commit SHA, brief notes.)
+Real prom-client implementation replacing the trace-log shim. All 10 Phase 1 metrics registered; `/healthz`, `/readyz` (cached SELECT 1 Postgres health check, 5 s TTL), `/metrics` endpoints live. Consumer lag sampled every 10 s via `XINFO GROUPS`. `createPostgresHealthCheck` and `createConsumerLagSampler` exported for graceful-shutdown wiring. 22 new unit tests in `test/metrics.test.ts`. *(pending commit SHA)*

.planning/phase-1-throughput/10-integration-test.md

@@ -1,7 +1,7 @@
 # Task 1.10 — Integration test (testcontainers Redis + Postgres)
 
 **Phase:** 1 — Throughput pipeline
-**Status:** ⬜ Not started
+**Status:** 🟩 Done
 **Depends on:** 1.5, 1.7, 1.8, 1.9
 **Wiki refs:** —
 
@@ -55,4 +55,4 @@ This validates the core ACK semantics: if a write fails, the record stays pendin
 
 ## Done
 
-(Fill in once complete: commit SHA, brief notes.)
+`test/pipeline.integration.test.ts`: four scenarios (happy path with bigint+Buffer, idempotency, malformed payload stays pending, writer failure → retry after Postgres restart). Uses `timescale/timescaledb:latest-pg16`; skip-on-no-Docker pattern verified (exits 0 without Docker). `pnpm test:integration` runs 4 tests green with Docker, 4 skips without. *(pending commit SHA)*

.planning/phase-1-throughput/11-dockerfile-and-ci.md

@@ -1,7 +1,7 @@
 # Task 1.11 — Dockerfile & Gitea workflow
 
 **Phase:** 1 — Throughput pipeline
-**Status:** ⬜ Not started
+**Status:** 🟩 Done
 **Depends on:** 1.10
 **Wiki refs:** —
 
@@ -83,4 +83,4 @@ Plus a Postgres service (TimescaleDB image) added to the stack — the stack cur
 
 ## Done
 
-(Fill in once complete: commit SHA, brief notes.)
+`Dockerfile` (multi-stage, `EXPOSE 9090` only, `HEALTHCHECK` on `/readyz`), `.gitea/workflows/build.yml` (mirrors tcp-ingestion; Portainer webhook uncommented), `compose.dev.yaml` (Redis + TimescaleDB + processor-dev), `README.md` fleshed out. *(pending commit SHA)*