metrics: ship Cloud Monitoring time series; refactor gcp_auth

Implements monitoring-plan.md.

- src/gcp_auth.rs: shared TokenProvider. Mints a multi-scope
  (logging.write + monitoring.write) JWT once and caches the bearer;
  cloud_log + metrics threads share it. Also moves http_post,
  parse_signing_key, b64url, now_unix_secs, unix_to_rfc3339,
  device_mac out of cloud_log.rs.
- src/cloud_log.rs: cloud_log::run takes Arc<TokenProvider> instead
  of owning the JWT/token state. LogQueue::stats() exposes depth +
  lifetime drop count for the metrics path.
- src/metrics.rs: periodic snapshot → POST /v3/projects/{id}/timeSeries.
  GAUGE INT64 metrics under custom.googleapis.com/esp32/<name>:
  free_heap, free_heap_internal, min_free_heap, largest_free_block,
  stack_hwm (label task=main|ota|cloud_log|metrics), wifi_rssi,
  wifi_channel, cpu_freq_mhz, uptime_secs, nvs_used/free_entries,
  cloud_log_queue_depth, cloud_log_dropped_total. Auto-creates
  MetricDescriptors on first POST. Cadence via NVS metric_intvl
  (gcp namespace), default 300s, 0 disables.
- Each spawned thread publishes its TaskHandle_t into a module-level
  AtomicUsize so metrics can read uxTaskGetStackHighWaterMark per
  task without holding handles for them. (Xtensa StackType_t is
  uint8_t, so the API returns bytes — no word-size multiplication.)

Plus:
- sdkconfig: enable CONFIG_MBEDTLS_DYNAMIC_BUFFER (+ free_config_data,
  free_ca_cert) so three concurrent TLS clients (cloud_log + metrics
  + OTA) don't blow our heap budget. Recovers ~15-25 KB per session.
- Makefile: `make flash` and `make run` now pass --partition-table.
  Without it, espflash 4.x writes a *default* (factory-only) partition
  table over our OTA layout, silently bricking OTA on the device.
- README + provisioning.toml.example: gcloud command for
  roles/monitoring.metricWriter; document metrics_interval_secs.
- tools/provision: write metric_intvl NVS u32 (default 300).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

provisioning.toml.example

@@ -30,7 +30,8 @@ issuer = "https://token.actions.githubusercontent.com"
 
 # Optional. If absent, the device boots with serial-only logging and
 # never tries to talk to GCP. Uncomment + fill in to enable shipping
-# tracing events (app + OTA) to Google Cloud Logging.
+# tracing events (app + OTA) to Google Cloud Logging and chip-health
+# metrics (heap, stack, wifi, cpu, uptime, …) to Cloud Monitoring.
 #
 # [gcp]
 # project_id = "my-logs-project"
@@ -38,3 +39,4 @@ issuer = "https://token.actions.githubusercontent.com"
 # sa_key_id = "abc123..."           # the `private_key_id` field from the SA JSON key
 # sa_key_pem = "gcp-sa-key.pem"     # path to the PKCS#8 RSA private key PEM
 # min_severity = "info"             # trace / debug / info / warn / error
+# metrics_interval_secs = 300       # 0 = metrics off (logs still ship); default 300