p2.7: prometheus /metrics

Default GET /metrics is Prometheus text; JSON stays at /metrics.json
and ?format=json. :8443 needs the metrics caller bearer; loopback
stays open. Restricted callers have no per-caller series and no
tavily:restricted gauge.

cmd/sift/serve.go

@@ -91,6 +91,19 @@ func serveMain() {
 		log.Error("keys", "err", err, "path", *keysPath)
 		os.Exit(1)
 	}
+	hasMetrics := false
+	for _, a := range store.Callers() {
+		if !a.MetricsOnly() {
+			continue
+		}
+		hasMetrics = true
+		if a.Workspace != "" {
+			log.Warn("metrics caller has workspace; ignored", "caller", a.Name)
+		}
+	}
+	if !hasMetrics {
+		log.Warn("no metrics caller in keys; :8443 /metrics will 401")
+	}
 
 	fetcher := &fetch.Fetcher{Guard: g, UA: *ua}
 	parent, stop := context.WithCancel(context.Background())