p2.7: prometheus /metrics

Default GET /metrics is Prometheus text; JSON stays at /metrics.json
and ?format=json. :8443 needs the metrics caller bearer; loopback
stays open. Restricted callers have no per-caller series and no
tavily:restricted gauge.

internal/auth/auth.go

@@ -16,12 +16,19 @@ import (
 	"github.com/pelletier/go-toml/v2"
 )
 
+const NameMetrics = "metrics"
+
 type Caller struct {
 	Name      string `toml:"name"`
 	Workspace string `toml:"workspace"`
 	KeySHA256 string `toml:"key_sha256"`
 }
 
+// MetricsOnly is the scrape-token caller: empty workspace, no fetch/search.
+func (c *Caller) MetricsOnly() bool {
+	return c != nil && c.Name == NameMetrics
+}
+
 type file struct {
 	Caller []Caller `toml:"caller"`
 }
@@ -107,6 +114,9 @@ func GenerateKey() (string, error) {
 }
 
 func Add(path, name, workspace, keyOut string) error {
+	if name == NameMetrics {
+		workspace = ""
+	}
 	if _, err := os.Stat(keyOut); err == nil {
 		return fmt.Errorf("refusing to overwrite %s", keyOut)
 	}

internal/auth/auth_test.go

@@ -3,6 +3,7 @@ package auth
 import (
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 )
 
@@ -69,3 +70,22 @@ func TestAddPreservesKeysMode(t *testing.T) {
 		t.Fatalf("mode %o", st.Mode().Perm())
 	}
 }
+
+func TestAddMetricsClearsWorkspace(t *testing.T) {
+	dir := t.TempDir()
+	keys := filepath.Join(dir, "keys.toml")
+	out := filepath.Join(dir, "k")
+	if err := Add(keys, NameMetrics, "hermes-fleet", out); err != nil {
+		t.Fatal(err)
+	}
+	cs, err := List(keys)
+	if err != nil || len(cs) != 1 || cs[0].Name != NameMetrics || cs[0].Workspace != "" {
+		t.Fatalf("%v %v", cs, err)
+	}
+	b, _ := os.ReadFile(out)
+	s, _ := Load(keys)
+	c := s.LookupBearer(strings.TrimSpace(string(b)))
+	if c == nil || !c.MetricsOnly() || c.Workspace != "" {
+		t.Fatalf("%+v", c)
+	}
+}