feat: add tenant-safe Trino monitoring routes and per-org query metrics

controlplane/admin/README.md

@@ -186,6 +186,37 @@ Prometheus response and retains only the `status`, `reason`, or `source` labels
 the corresponding chart. Unknown metrics and windows return 400; unknown orgs
 return 404 with `code: "managed_warehouse_not_found"` before Prometheus is called.
 
+#### Trino monitoring (`monitoring_trino.go`)
+
+The PostHog backend reads `GET /api/v1/orgs/:id/monitoring/trino/snapshot` and
+`/monitoring/trino/series` for organizations whose customers query through
+Trino. Auth and scoping follow the rules above: internal secret only, and the
+org is fixed by the path.
+
+The snapshot reports the org's Trino lifecycle state (`not_enabled`, `pending`,
+`provisioning`, `ready`, `failed`), its tier's concurrency and queue limits,
+in-flight totals, and at most 200 in-flight queries, longest-running first.
+`available` is false when the coordinator or the org index cannot be read; the
+totals are then zero and must not be shown as an idle warehouse. `in_flight`
+counts every non-terminal query. `running` counts every in-flight query past
+the queue, which is what the concurrency limit counts, so
+`in_flight = running + queued`. `blocked` is the subset of `running` whose
+drivers are all blocked. `longest_running_ms` is the longest elapsed time since
+submission among all in-flight queries, queued ones included. Query text has
+literals replaced with `?` and comments removed (`trino_sql_mask.go`), and
+becomes a fixed placeholder when it cannot be lexed. The snapshot intentionally omits cell ids, Trino principals,
+resource-group and tier names, status messages, driver counts, error codes, and
+connection details.
+
+The series endpoint accepts only `queries_in_flight`, `query_rate`,
+`error_ratio`, `duration_p50`, `duration_p95`, `queue_time_p95`,
+`scanned_bytes_rate`, `cpu_seconds_rate`, and `storage_bytes`, over the same
+windows as the DuckDB series endpoint. Every query carries an exact `org` label
+selector, and only the `state`, `status`, and `error_type` labels are returned.
+Unknown metrics and windows return 400 and unknown orgs return 404 with
+`code: "managed_warehouse_not_found"`, both before Prometheus is called. The
+metrics are defined in `docs/metrics.md`, "Per-org Trino query metrics".
+
 ### Trino cell views (`trino.go` + `trino_client.go`)
 
 The **Trino cell → Instance recovery** panel lets admins select a shared-pool

controlplane/admin/extras.go

@@ -38,6 +38,7 @@ func RegisterExtras(r *gin.RouterGroup, x Extras) {
 	r.GET("/me", meHandler)
 	registerLiveAPI(r, x.Live, x.Fetcher, x.Users)
 	registerMonitoringAPI(r, x.Monitoring, x.Live, x.Fetcher, x.Metrics, x.MonitoringWorkerDefaults)
+	registerTrinoMonitoringAPI(r, x.Monitoring, x.Trino, x.Metrics)
 	if x.ClusterClient != nil {
 		registerClusterAPI(r, x.ClusterClient)
 	}