p2.7: prometheus /metrics

Default GET /metrics is Prometheus text; JSON stays at /metrics.json
and ?format=json. :8443 needs the metrics caller bearer; loopback
stays open. Restricted callers have no per-caller series and no
tavily:restricted gauge.

internal/auth/auth_test.go

@@ -3,6 +3,7 @@ package auth
 import (
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 )
 
@@ -69,3 +70,22 @@ func TestAddPreservesKeysMode(t *testing.T) {
 		t.Fatalf("mode %o", st.Mode().Perm())
 	}
 }
+
+func TestAddMetricsClearsWorkspace(t *testing.T) {
+	dir := t.TempDir()
+	keys := filepath.Join(dir, "keys.toml")
+	out := filepath.Join(dir, "k")
+	if err := Add(keys, NameMetrics, "hermes-fleet", out); err != nil {
+		t.Fatal(err)
+	}
+	cs, err := List(keys)
+	if err != nil || len(cs) != 1 || cs[0].Name != NameMetrics || cs[0].Workspace != "" {
+		t.Fatalf("%v %v", cs, err)
+	}
+	b, _ := os.ReadFile(out)
+	s, _ := Load(keys)
+	c := s.LookupBearer(strings.TrimSpace(string(b)))
+	if c == nil || !c.MetricsOnly() || c.Workspace != "" {
+		t.Fatalf("%+v", c)
+	}
+}