feat(observability): protect /metrics with admin session or bearer token (Phase 10)

[JesseJohn7]

Summary

Restricts GET /metrics to authorized scrapers. The endpoint is refused by default and never exposed publicly.

Changes

• New app/observability/auth.py:
  • Allows a request carrying a bearer token that matches METRICS_BEARER_TOKEN (constant-time comparison, minimum 16 characters, can be set via app config or environment).
  • Otherwise allows an authenticated admin session.
  • Everything else is refused: 401 (with WWW-Authenticate: Bearer) for missing or invalid credentials, 403 for a signed-in non-admin.
• app/observability/routes.py enforces the check after the existing METRICS_ENABLED switch (404 when disabled). Refusals carry no metric data and Cache-Control: no-store.
• With no token configured, only admin sessions can read metrics (fail closed).
• .env.example and docs/observability.md document METRICS_BEARER_TOKEN, access rules and a Prometheus scrape config.

Tests

• New tests/test_metrics_auth.py: anonymous refused, refused by default with no token, no leakage in refusals, valid/wrong/case-insensitive/non-bearer tokens, short tokens ignored, token from environment, wrong token refused even with an admin session, admin session allowed, non-admin 403, anonymous 401, disabled endpoint 404.
• tests/test_metrics.py updated to scrape with a token.

ruff check ., black --check . and pytest pass locally.

Depends on #476 (metrics endpoint).

Closes #477

[drips-wave]

@JesseJohn7 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits