Move /metrics from prom-client to @prometheus-io/client once it reaches 1.0 #1169

prom-client (used by the opt-in Prometheus /metrics listener, #1131) is now marked deprecated on npm: "prom-client has been replaced by @prometheus-io/client". The successor lives under the Prometheus org (github.com/prometheus/client_js) and is at 0.16.1, first published in August 2026.

prom-client 15.1.3 still works, so nothing is urgent. Once @prometheus-io/client is at 1.0:

• swap the dependency in packages/backend/package.json;
• adapt packages/backend/src/common/metrics.ts, which is the only file that imports it, so the change stays in one place;
• check that the metric names, the default runtime metrics and the metrics.spec.ts assertions stay the same, so existing Prometheus dashboards keep working.