p2.7: prometheus /metrics

Default GET /metrics is Prometheus text; JSON stays at /metrics.json
and ?format=json. :8443 needs the metrics caller bearer; loopback
stays open. Restricted callers have no per-caller series and no
tavily:restricted gauge.

internal/api/search_test.go

@@ -133,20 +133,6 @@ func TestHealthzMissingKey(t *testing.T) {
 	}
 }
 
-func TestMetricsCacheHitMiss(t *testing.T) {
-	s, key, _, _, _ := searchServer(t)
-	postJSON(t, s, "/v1/search", key, map[string]any{"query": "same q", "k": 5, "rerank": false})
-	postJSON(t, s, "/v1/search", key, map[string]any{"query": "same q", "k": 5, "rerank": false})
-	req := httptest.NewRequest(http.MethodGet, "/metrics", nil)
-	rec := httptest.NewRecorder()
-	s.ServeHTTP(rec, req)
-	var m map[string]any
-	_ = json.Unmarshal(rec.Body.Bytes(), &m)
-	if m["search_cache_hit"] == 0 && m["search_cache_miss"] == 0 {
-		t.Fatalf("%v", m)
-	}
-}
-
 func TestNoSearchResults422(t *testing.T) {
 	s, key := setupAPI(t, nil)
 	s.Search = &search.Engine{DefaultK: 8}