orion: read-only vmui via nginx allowlist + serve :8429

VictoriaMetrics stays loopback :8428. nginx :8429 allows GET/POST
to /vmui and query APIs only; import/admin/export/flags 403.
tailscale serve HTTPS 8429. Review, no switch.

hw/orion/metrics.nix

@@ -1,7 +1,15 @@
 # Phase 1 metrics store + alerting. VictoriaMetrics on loopback; scrape
 # orion locally and dixie over the tailnet. Do not switch until reviewed.
-{ ... }:
+{ pkgs, ... }:
 let
+  vm = "http://127.0.0.1:8428";
+  vmuiProxy = {
+    proxyPass = vm;
+    extraConfig = ''
+      limit_except GET POST { deny all; }
+    '';
+  };
+
   honchoKeep = "up|deriver_queue_items_pending|deriver_queue_oldest_pending_age_seconds|deriver_queue_work_units_claimed|deriver_queue_work_units_eligible|dialectic_calls.*|db_connections_open|db_queries_in_flight";
   honchoRelabel = [
     { source_labels = [ "__name__" ]; regex = honchoKeep; action = "keep"; }
@@ -262,4 +270,47 @@ in
       ];
     };
   };
+
+  # Read-only vmui: path-allowlist on loopback, then tailscale serve HTTPS 8429.
+  # VictoriaMetrics stays 127.0.0.1:8428. Writes/admin/export are 403.
+  services.nginx = {
+    enable = true;
+    recommendedProxySettings = true;
+    virtualHosts.vmui = {
+      listen = [
+        {
+          addr = "127.0.0.1";
+          port = 8429;
+          extraParameters = [ "default_server" ];
+        }
+      ];
+      locations = {
+        "/" = {
+          extraConfig = "return 403;";
+        };
+        "/vmui" = vmuiProxy;
+        "= /api/v1/query" = vmuiProxy;
+        "= /api/v1/query_range" = vmuiProxy;
+        "= /api/v1/series" = vmuiProxy;
+        "= /api/v1/labels" = vmuiProxy;
+        "~ ^/api/v1/label/[^/]+/values$" = vmuiProxy;
+        "= /api/v1/metadata" = vmuiProxy;
+        "/api/v1/status" = vmuiProxy;
+      };
+    };
+  };
+
+  systemd.services.tailscale-serve-vmui = {
+    description = "Advertise read-only vmui on Tailscale Serve :8429";
+    after = [ "tailscaled.service" "network-online.target" "nginx.service" ];
+    wants = [ "tailscaled.service" "network-online.target" ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      Restart = "on-failure";
+      RestartSec = "5s";
+      ExecStart = "${pkgs.tailscale}/bin/tailscale serve --bg --yes --https=8429 http://127.0.0.1:8429";
+    };
+  };
 }