P3.2+P3.3+P3.4: NODA1 node-worker + NATS auth config + Prometheus counters

P3.2 — Multi-node deployment:
- Added node-worker service to docker-compose.node1.yml (NODE_ID=noda1)
- NCS NODA1 now has NODE_WORKER_URL for metrics collection
- Fixed NODE_ID consistency: router NODA1 uses 'noda1'
- NODA2 node-worker/NCS gets NCS_REPORT_URL for latency reporting

P3.3 — NATS accounts/auth (opt-in config):
- config/nats-server.conf with 3 accounts: SYS, FABRIC, APP
- Per-user topic permissions (router, ncs, node_worker)
- Leafnode listener :7422 with auth
- Not yet activated (requires credential provisioning)

P3.4 — Prometheus counters:
- Router /fabric_metrics: caps_refresh, caps_stale, model_select,
  offload_total, breaker_state, score_ms histogram
- Node Worker /prom_metrics: jobs_total, inflight gauge, latency_ms histogram
- NCS /prom_metrics: runtime_health, runtime_p50/p95, node_wait_ms
- All bound to 127.0.0.1 (not externally exposed)

Made-with: Cursor

services/router/model_select.py

@@ -326,6 +326,12 @@ async def select_model_for_agent(
                 f"{' (force_local)' if force_local else ''}"
                 f"{' (excluded: ' + ','.join(excl) + ')' if excl else ''}"
             )
+            try:
+                from fabric_metrics import inc_model_select, observe_score
+                inc_model_select(sel.node, sel.runtime, reqs.required_type)
+                observe_score(sel.score)
+            except ImportError:
+                pass
             return sel
         logger.warning(
             f"[select] agent={agent_id} profile={profile} → no match "