# Fix BYOC node metrics target resolution

## Background

The cloud node metrics proxy currently resolves every data-plane metrics target with the Dedicated project lookup. BYOC clusters are identified in O11Y by tenant and data-plane application ID instead. The handler also continues after an O11Y lookup error and dereferences the missing result.

## Goal and target contract

- Resolve BYOC data-plane metrics with provider, physical region, tenant ID, and `DataPlaneName`.
- Use the O11Y cluster's canonical `InternalReadUri` and BYOC forwarding headers.
- Stop immediately on lookup, validation, or URL parsing failures.
- Preserve the existing non-BYOC project lookup and node-metric filtering contract.
- Emit safe request lifecycle logs with the request trace ID.

## Affected modules and routes

- Root Go module: `pkg/o11y/urls`, `pkg/proxy`, and `cmd/server`.
- Customer-facing routes under `/metric/node/query/api/v1/*`.
- Runtime image: `clinic`.
- Clinic CD component: `clinic`.
- app-delivery application/workload: `clinic-api` / Clinic Deployment.

## Implementation

1. Add a focused node-metrics target resolver that selects the BYOC data-plane lookup for legacy and V2 BYOC shapes and validates the returned target.
2. Keep the existing project lookup for non-BYOC clusters, but move its error and nil validation into the resolver.
3. Forward BYOC requests through the canonical internal-read URL while retaining the existing response filtering and BYOC headers.
4. Replace request-scoped raw query/response logging in the modified path with bounded structured lifecycle logging.
5. Add resolver and proxy-target regression tests for BYOC identity, non-BYOC compatibility, empty targets, and invalid URLs.

## Compatibility and exclusions

- Metric allowlists, PromQL rewriting, tenant filtering, and response shapes remain unchanged.
- Dedicated, Premium, and NextGen identity rules are not redesigned in this change.
- No API schema, database, workflow, or app-delivery configuration change is required.

## Validation

- Run the focused `pkg/o11y/urls` and `pkg/proxy` tests first, then the complete affected packages.
- Run formatting, `git diff --check`, and the repository lint checks applicable to the changed Go files.
- In staging, deploy `components=clinic`, verify the Clinic image and Pod health, exercise BYOC node series/query_range requests, and correlate safe logs by `trace_id`.

## Release boundary

This change is implementation-only until reviewed. It must not be committed, pushed, deployed, or merged without separate authorization.