feat(web): wire session-telemetry-otel into the dsh web composition

Mount the existing telemetry seam + OTel logs backend in the web/headless
config tree so every session-log event streams to an OTLP/HTTP collector:

- telemetry-otel row: url defaults to the standard local OTLP endpoint,
  DSH_TELEMETRY_OTLP_URL overrides; 10s batch cadence; exporter/processor
  values bound the shutdown drain to ~1s against an unreachable collector
  (timeoutMillis doubles as the retry deadline, single-batch drain).
- DSH_TELEMETRY_DISABLED opt-out: AppCLIEntry patches the row disabled
  before boot (config alone cannot disable a row, and exporter.url
  validation is load-time fail-loud).

apps/cli/src/app-cli-entry.ts

@@ -203,6 +203,13 @@ export class AppCLIEntry {
       if (yml === undefined) throw new Error(`dsh: patch target row "${id}" not found in ${this.options.configPath}`)
       return { id, config: { ...(yml.config ?? {}) as Record<string, unknown>, ...bag } }
     })
+
+    // Telemetry opt-out: a row can only be turned off at the patch layer
+    // (config cannot disable an entry), and the switch must hold BEFORE the
+    // plugin constructs — its exporter.url validation is load-time fail-loud.
+    if ((process.env.DSH_TELEMETRY_DISABLED ?? '') !== '') {
+      this.patches.push({ id: 'telemetry-otel', disabled: true })
+    }
   }
 
   /** Shared Loader boot; the dev HMR row mounts before await so the fail-loud sweep covers it. */