feat(api): add monitoring feature with track_events use case

[eoaksnes]

Stack 2/4 — base: `stack/01-infra` (#538)

Adds an API-side monitoring feature for application telemetry.

Stack

1. chore(infra): IaC, compose, redis, oauth2-proxy baseline #538 stack/01-infra
2. stack/02-api ← you are here
3. stack/03-web (base: stack/02-api)
4. stack/04-docs (base: stack/03-web)

---

This pull request introduces a new monitoring/telemetry endpoint, upgrades Azure and OpenTelemetry dependencies, and improves authentication and observability integration. It also includes minor improvements and maintenance updates.

Key changes:

Monitoring and Telemetry

• Added a new /monitoring/v2/track POST endpoint to the OpenAPI spec for tracking telemetry events, including comprehensive request/response schemas and error handling.
• Introduced telemetry-related schemas: Event, EventBase, EventData, ExceptionData, MetricsData, TelemetryErrorDetails, and TelemetryResult to support the new monitoring endpoint. [1] [2]
• Registered the new monitoring router in the FastAPI application to enable the endpoint. [1] [2]

Observability and Dependency Upgrades

• Upgraded Azure and OpenTelemetry dependencies for better compatibility and features, including switching to azure-identity and newer versions of azure-monitor-opentelemetry and related exporters. [1] [2]
• Improved Azure Monitor integration: now uses a ClientSecretCredential when service principal credentials are available, allowing ingestion even when local authentication is disabled. Falls back to connection-string auth otherwise.

Authentication Improvements

• Enhanced JWT authentication to extract and populate user details (user_id, full_name, email, roles) from the token payload, improving downstream user context. [1] [2]

API and Schema Consistency

• Added user_id as a required field in multiple todo response schemas for consistency and traceability. [1] [2] [3] [4]

Developer Experience and Maintenance

• Ensured the Equinor root CA bundle is installed in the Docker image for secure requests behind corporate proxies (e.g., Zscaler), improving developer experience and CI reliability. [1] [2]
• Updated type imports for secrets handling in configuration.

These changes collectively improve the API's observability, security, and maintainability while adding support for advanced telemetry use cases.