E3: API access-log toggle + self-metrics

[LarsLaskowski]

Epic: Cross-cutting / smaller items

Why

withLogging (internal/httpapi/middleware.go:11) logs every request at debug level with no way to tune it, and PiMonitor exposes no counters about its own HTTP surface.

Scope

A config toggle / level for access logging, plus optional in-memory request counters (total, per-status-class, per-path-prefix) surfaced either on the Prometheus endpoint (B1, if present) or a small GET /api/v1/serverstats.

Reuse & touch points

• internal/httpapi/middleware.go — extend withLogging to also increment counters.
• internal/config/config.go — access_log_enabled.
• Optionally feed the counters into B1 (Prometheus endpoint).

API & config impact

Additive endpoint/metrics; config toggle. No breaking change.

Acceptance criteria

• Counters increment as expected under httptest traffic.
• Disabling access logging suppresses the per-request log lines.