feat: add Grafana Tempo for tracing

[netroms]

Add Distributed Tracing with Grafana Tempo and OpenTelemetry

Summary

• Add Grafana Tempo for distributed trace storage and visualization
• Instrument DHIS2 with OpenTelemetry Java Agent for automatic tracing of HTTP requests and database queries
• Enable seamless correlation between traces, logs, and metrics in Grafana
• Added boasystem PostGIS as an option, because it has support for Arm64 architecture
• Added update-admin-password to depends_on in the Traefik service, so we don't serve DHIS2 public if password fails to be set

Architecture

┌────────────────────────────────────────────────────────────┐
│                     DHIS2 Container                        │
│  ┌─────────────────────────────────────────────────────┐   │
│  │  DHIS2 Application                                  │   │
│  │         │                                           │   │
│  │  OpenTelemetry Java Agent (auto-instrumentation)    │   │
│  └─────────────────────────────────────────────────────┘   │
│              │ traces (OTLP)       │ logs (with trace_id)  │
└──────────────┼─────────────────────┼───────────────────────┘
               ▼                     ▼
         ┌──────────┐          ┌──────────┐
         │  Tempo   │◄────────►│   Loki   │
         └──────────┘          └──────────┘
               │                     │
               └──────────┬──────────┘
                          ▼
                    ┌──────────┐
                    │ Grafana  │
                    └──────────┘

Changes

New Services:

• tempo - Grafana Tempo for trace storage (OTLP receiver on port 4318)
• tempo-init - Volume permission initialization
• otel-init - Downloads OpenTelemetry Java Agent JAR

DHIS2 Instrumentation:

• OpenTelemetry Java Agent added via JAVA_TOOL_OPTIONS
• Auto-instruments: HTTP requests, JDBC/PostgreSQL, Hibernate, Spring MVC
• Log pattern updated to include trace_id and span_id for correlation

What This Enables

1. View traces in Grafana Tempo—See distributed traces with spans for HTTP requests and SQL queries
2. Jump from logs to traces—Click on a log line in Loki to see the full trace
3. Jump from traces to logs—Click on a trace span to see all related logs
4. See SQL query timing—The OTel agent captures JDBC calls as spans with query duration
5. Debug slow requests—Follow a request from Traefik → DHIS2 → Database

Test Plan

• Verify Tempo starts and is healthy
• Make HTTP requests to DHIS2 and verify traces appear in Tempo
• Verify OpenTelemetry agent attaches to DHIS2 (check logs for agent version)
• Verify SQL queries appear as spans within traces
• Test log-to-trace correlation in Grafana (click TraceID in Loki)
• Test trace-to-log correlation (click "Logs" button in Tempo trace view)

[radnov]

Looks good! Minor comment added.

[bobjolliffe]

Few small comments on tempo config.

[bobjolliffe]

For profiling you will probably not want to have both tempo and glowroot. Better to pick one (or none)?

[netroms]

maybe it's better to have a separate make command for this, like "make profiling"?