fix(proxy): wire PR #6207 snapshot-apply metrics

The SyncMappings restore in 036e91cde kept the metric definitions
(RecordSnapshotSyncDuration, RecordSnapshotBatchDuration,
RecordAddPeerDuration) and the corresponding callbacks (OnAddPeer)
but lost their call sites — they shipped as dead code.

- proxy/server.go: introduce snapshotTracker (the type PR #6207 added
  to share batch/sync timing between handleMappingStream and
  handleSyncMappingsStream); both stream handlers now go through it.
- proxy/internal/roundtrip/netbird.go: add OnAddPeer struct field and
  invoke it after createClientEntry with the per-call duration.
- proxy/server.go: wire s.netbird.OnAddPeer = s.meter.RecordAddPeerDuration
  alongside the existing NetBird construction.

No new test coverage — PR #6207's bench tests already exercise the
batch/sync paths and continue to pass.

proxy/internal/roundtrip/netbird.go

@@ -170,6 +170,11 @@ type NetBird struct {
 	// stopHandler runs when an account's last service is removed (or the
 	// transport is shutting down). Receives whatever readyHandler returned.
 	stopHandler func(accountID types.AccountID, state any)
+
+	// OnAddPeer, when set, is called after AddPeer completes for a new account
+	// (i.e. when a new client was actually created, not when an existing one
+	// was reused). The duration covers keygen + gRPC CreateProxyPeer + embed.New.
+	OnAddPeer func(d time.Duration, err error)
 }
 
 // ClientDebugInfo contains debug information about a client.
@@ -217,7 +222,11 @@ func (n *NetBird) AddPeer(ctx context.Context, accountID types.AccountID, key Se
 		return nil
 	}
 
+	createStart := time.Now()
 	entry, err := n.createClientEntry(ctx, accountID, key, authToken, si)
+	if n.OnAddPeer != nil {
+		n.OnAddPeer(time.Since(createStart), err)
+	}
 	if err != nil {
 		n.clientsMux.Unlock()
 		return err