API Surface
All routes under /api. X-API-Key required (bypassed in development).
All routes under /api except /health and /api/metrics require X-API-Key (bypassed in development).
GET /health— API + DB healthPOST /api/recommendations— ranked VM recommendationsGET /api/providers,/api/regions,/api/instance-types,/api/pricesGET /api/price-analytics/changes,/api/price-analytics/trendsGET /api/metrics— Prometheus