p2.7: prometheus /metrics

Default GET /metrics is Prometheus text; JSON stays at /metrics.json
and ?format=json. :8443 needs the metrics caller bearer; loopback
stays open. Restricted callers have no per-caller series and no
tavily:restricted gauge.

internal/metrics/metrics_test.go

@@ -0,0 +1,41 @@
+package metrics
+
+import (
+	"net/http/httptest"
+	"testing"
+)
+
+func TestLoopbackOpen(t *testing.T) {
+	req := httptest.NewRequest("GET", "/metrics", nil)
+	if LoopbackOpen(req) {
+		t.Fatal("httptest default must not be open")
+	}
+	req.RemoteAddr = "127.0.0.1:9"
+	req.Host = "127.0.0.1:8890"
+	if !LoopbackOpen(req) {
+		t.Fatal("loopback host+addr")
+	}
+	req.Header.Set("X-Forwarded-For", "100.1.2.3")
+	if LoopbackOpen(req) {
+		t.Fatal("forwarded-for is :8443")
+	}
+	req.Header.Del("X-Forwarded-For")
+	req.Host = "orion.scylla-hammerhead.ts.net:8443"
+	if LoopbackOpen(req) {
+		t.Fatal("tailnet Host is :8443")
+	}
+	req.Host = "localhost:8890"
+	req.RemoteAddr = "[::1]:9"
+	if !LoopbackOpen(req) {
+		t.Fatal("localhost v6")
+	}
+}
+
+func TestCoerceFallback(t *testing.T) {
+	if CoerceFallback("queue_full") != "queue_full" {
+		t.Fatal("keep")
+	}
+	if CoerceFallback("blocked: resolve evil.example") != "other" {
+		t.Fatal("raw must not pass")
+	}
+}