Improve OTel and Sentry auth observability

- Add configurable claim extraction to OTel spans (claim_attributes) and
  Sentry tags (claim_tags) via shared _format_claim_value helper
- Add auth.domain to OTel metrics for per-auth-method rate/latency breakdown
- Add rpc.server.auth_failure counter for HTTP 401 rejections (pre-dispatch)
- Add auth.authenticated tag to Sentry scope
- Migrate deprecated OTel semconv: enduser.id → rpc.vgi_rpc.auth.principal,
  net.peer.ip → client.address

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: rustyconover