feat(helm): add OpenTelemetry export configuration

[hibare]

Summary

Adds chart-level support for the OpenTelemetry export pipeline introduced in #14. Operators can now enable OTLP/gRPC export via standard Helm values without extraEnv workarounds.

Changes

• values.yaml — adds config.otel block (7 settings) with enabled: false default; adds commented OTLP/gRPC egress example under networkPolicy.egress.
• configmap.yaml — renders the otel: section in the runtime config only when otel.enabled=true. Disabled-state output is unchanged from before this PR.
• values.schema.json — type/range validation: sampleRate constrained to [0.0, 1.0], protocol enum-locked to "grpc" to match what the Go validator accepts. helm lint catches misconfigured values at install time.
• README.md — adds OpenTelemetry section under Production deployment and parameter table under Parameters.

Example

config:
  otel:
    enabled: true
    endpoint: "otel-collector.observability.svc:4317"
    sampleRate: 0.1

Design notes

• Default enabled: false — existing installs are unaffected; OTel must be explicitly opted into.
• Default endpoint: "" — intentionally diverges from the Go default localhost:4317 so a misconfigured cluster fails fast at startup rather than silently dialing localhost.
• Egress rule is commented, matching the existing Redis/Postgres pattern; operators choose their collector location and uncomment.
• No Terraform changes needed — modules cover AWS infra (Secrets Manager, ACM, ALB, EKS); collector deployment is out-of-band (sidecar / DaemonSet / managed AMP).