Prometheus metrics at /metrics, configured in jarl.yaml

New metrics: section (enabled, listen, allow, token). /metrics is served on
the main listeners, the local socket (root and jarld's user) and optional
metrics-only addresses; a scrape needs an allowed address or the bearer
token. Exports health (named up, problems, drift, backups, blocklists,
DNSSEC phases, token expiry) and, with stats on, named's and Jarl's query
counters since jarld started plus named's process and cache gauges.
docs/metrics.md has example queries and alerts checked with promtool.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/operations.md

@@ -363,6 +363,9 @@ rndc reconfig
 ## Monitoring
 
 * `GET /healthz` (no authentication) reports that jarld is up.
+* Prometheus: `/metrics` covers named up, configuration problems, drift,
+  blocklist failures, backup age, DNSSEC steps waiting at the parent and
+  expiring tokens, with example alerts ([metrics.md](metrics.md)).
 * On the server, a check can use the local socket and needs no token:
   `sudo jarl status -o json`.
 * `GET /api/v1/status` with a read-only token reports named reachability,