p2.7: prometheus /metrics

Default GET /metrics is Prometheus text; JSON stays at /metrics.json
and ?format=json. :8443 needs the metrics caller bearer; loopback
stays open. Restricted callers have no per-caller series and no
tavily:restricted gauge.

internal/fleetctx/fleetctx_test.go

@@ -202,4 +202,9 @@ func TestCheckMappingsWarnsMissingKey(t *testing.T) {
 	if strings.Contains(buf.String(), "no key") || strings.Contains(buf.String(), "mapped off") {
 		t.Fatalf("mapped ok still logged: %s", buf.String())
 	}
+	buf.Reset()
+	c.CheckMappings([]CallerWS{{Name: "metrics", Workspace: ""}})
+	if strings.Contains(buf.String(), "mapped off") {
+		t.Fatalf("metrics caller treated as restricted map: %s", buf.String())
+	}
 }