p2.7: prometheus /metrics

Default GET /metrics is Prometheus text; JSON stays at /metrics.json
and ?format=json. :8443 needs the metrics caller bearer; loopback
stays open. Restricted callers have no per-caller series and no
tavily:restricted gauge.

internal/fleetctx/fleetctx.go

@@ -17,6 +17,8 @@ import (
 	"sync/atomic"
 	"time"
 	"unicode/utf8"
+
+	"git.wntrmute.dev/kyle/sift/internal/auth"
 )
 
 const (
@@ -202,6 +204,9 @@ func (c *Client) CheckMappings(callers []CallerWS) {
 	have := make(map[string]struct{}, len(callers))
 	for _, a := range callers {
 		have[a.Name] = struct{}{}
+		if a.Name == auth.NameMetrics {
+			continue
+		}
 		if permitted(a.Name, c.Permit) && !restricted(a.Workspace) {
 			if c.Log != nil {
 				c.Log.Error("restricted caller mapped off guardian-star", "caller", a.Name, "workspace", a.Workspace)

internal/fleetctx/fleetctx_test.go

@@ -202,4 +202,9 @@ func TestCheckMappingsWarnsMissingKey(t *testing.T) {
 	if strings.Contains(buf.String(), "no key") || strings.Contains(buf.String(), "mapped off") {
 		t.Fatalf("mapped ok still logged: %s", buf.String())
 	}
+	buf.Reset()
+	c.CheckMappings([]CallerWS{{Name: "metrics", Workspace: ""}})
+	if strings.Contains(buf.String(), "mapped off") {
+		t.Fatalf("metrics caller treated as restricted map: %s", buf.String())
+	}
 }