feat: establish APM facade contract

[rlaope]

Summary

• Add argus-apm as the public APM facade contract module with scoped models, DTOs, backend link routing, JVM-finding correlation, demo topology, guardrails, authorization, and self-metrics.
• Add the local APM dashboard page and nav entry with preview/live modes, scoped backend-links URLs, safe local drilldowns, malformed live-payload fail-closed handling, and namespace/name service identity preservation.
• Document the APM facade/security boundary so public APM work stays separated from internal aggregator routes.

Distributed Environment Check

• Tenant/project/environment/service scope is explicit in the model, and backend-links authorization now binds request.service into the authorized scope before allowing a link response.
• Live dashboard links use the facade/live filter scope rather than sample data, so multi-tenant and multi-environment links do not drift.
• Structured service identity is preserved as namespace/name when facade payloads provide { namespace, name }, reducing collision risk across namespaces.
• Public frontend smoke guards prevent browser code from calling raw aggregator /fleet, /api/pods, or /profile routes.
• Current status: strong APM foundation and distributed contract shell; production distributed rollout still needs the real authenticated facade service, partial backend-failure semantics, and trace redaction for hidden cross-service spans.

Review Fixes Included

• Fixed backend-links service allowlist bypass risk by adding backend-links-specific authorization.
• Fixed live backend-link URL scope drift away from sample constants.
• Fixed malformed live facade payloads from crashing rendering by failing closed to Offline.

Verification

• node --check argus-frontend/src/main/resources/public/js/apm.js
• git diff --cached --check
• ./gradlew :argus-apm:test --tests io.argus.apm.ApmSecurityAndGuardrailsTest
• ./gradlew :argus-server:test --tests io.argus.server.metrics.DashboardStaticAssetsSmokeTest
• Playwright smoke: live scope links, structured service identity, local href sanitization, malformed payload fail-closed, preview mode
• Clean-worktree ./gradlew test

Local Note

• The main working tree still has unrelated untracked local duplicate files such as * 2.java; they are intentionally not part of this PR. A clean worktree test passed without them.