perf/deploy: optimize hot-path allocs (cut per-session ad_tag allocations), split metrics module, and add ENV config support

Three independent changes bundled here — performance, maintainability, and
deployment DX.

1. Hot-path Allocations (ad_tag caching):
Every middle-relay session was doing a hex::decode of the user's ad_tag (plus a fallback to the global one) on every single connection. That's two string allocations and two hex decodes per session for data that only changes on config reload. Moved the decoding into ProxyConfig load/hot-reload into a precomputed runtime_ad_tags cache (same #[serde(skip)] pattern as runtime_user_auth). The session path now does a single O(1) lookup via config.effective_ad_tag(&user). Falls back to on-demand decode if the cache isn't built (e.g. in tests), so existing behavior is preserved. This eliminates two useless allocations and hex decodes per connection.

2. Metrics Monolith Split(structural refactor):
Broke up the massive 4,200-line `metrics.rs` into a proper `metrics/` directory module (`mod.rs`, `tls_front.rs`, `tests.rs`). I isolated the giant `render_metrics` function into its own `render.rs` file. This was a purely structural move—no locks or function bodies were changed, keeping things build-safe while making the crate significantly easier to navigate. The /metrics endpoint output is byte-identical.

3. GitOps / Dokploy Auto-Deployment Support (deployment DX):
Added `figment` to `Cargo.toml` to seamlessly merge TOML config files with Environment Variables. You can now configure the proxy entirely using `TELEMT_` prefixed ENV variables (e.g., `TELEMT_GENERAL__PORT=443`) without needing to manually mount a physical `config.toml` via Docker volumes. The Dockerfile and compose setups now gracefully handle missing config files by generating an empty placeholder, making stateless auto-deployments on platforms like Dokploy frictionless.

docker-compose.yml

@@ -14,15 +14,22 @@ services:
     # Config is mounted as a directory (not a single file) so the API can
     # atomically update config.toml via write-temp → rename within the same FS.
     working_dir: /run/telemt
-    command: ["/etc/telemt/config.toml"]
-    volumes:
-      - ./config:/etc/telemt:rw
+    # Optional: Mount config directory if you want to use the API to mutate config.toml
+    # In ENV-driven mode, the config is read from /app/config.toml and ENV vars
+    # override config values. To use file-based/API-edit mode instead, uncomment
+    # the volume below AND change the command to ["/etc/telemt/config.toml"].
+    command: ["/app/config.toml"]
+    # volumes:
+    #   - ./config:/etc/telemt:rw
     tmpfs:
       - /run/telemt:rw,mode=1777,size=4m
     environment:
       - RUST_LOG=info
+      # ENV variables can be used to override config values:
+      # - TELEMT_GENERAL__PORT=443
+      # - TELEMT_GENERAL__AD_TAG=1234567890abcdef1234567890abcdef
     healthcheck:
-      test: [ "CMD", "/app/telemt", "healthcheck", "/etc/telemt/config.toml", "--mode", "liveness" ]
+      test: [ "CMD", "/app/telemt", "healthcheck", "/app/config.toml", "--mode", "liveness" ]
       interval: 30s
       timeout: 5s
       retries: 3