p2.7: prometheus /metrics

Default GET /metrics is Prometheus text; JSON stays at /metrics.json
and ?format=json. :8443 needs the metrics caller bearer; loopback
stays open. Restricted callers have no per-caller series and no
tavily:restricted gauge.

internal/auth/auth.go

@@ -16,12 +16,19 @@ import (
 	"github.com/pelletier/go-toml/v2"
 )
 
+const NameMetrics = "metrics"
+
 type Caller struct {
 	Name      string `toml:"name"`
 	Workspace string `toml:"workspace"`
 	KeySHA256 string `toml:"key_sha256"`
 }
 
+// MetricsOnly is the scrape-token caller: empty workspace, no fetch/search.
+func (c *Caller) MetricsOnly() bool {
+	return c != nil && c.Name == NameMetrics
+}
+
 type file struct {
 	Caller []Caller `toml:"caller"`
 }
@@ -107,6 +114,9 @@ func GenerateKey() (string, error) {
 }
 
 func Add(path, name, workspace, keyOut string) error {
+	if name == NameMetrics {
+		workspace = ""
+	}
 	if _, err := os.Stat(keyOut); err == nil {
 		return fmt.Errorf("refusing to overwrite %s", keyOut)
 	}