Prometheus metrics at /metrics, configured in jarl.yaml

New metrics: section (enabled, listen, allow, token). /metrics is served on
the main listeners, the local socket (root and jarld's user) and optional
metrics-only addresses; a scrape needs an allowed address or the bearer
token. Exports health (named up, problems, drift, backups, blocklists,
DNSSEC phases, token expiry) and, with stats on, named's and Jarl's query
counters since jarld started plus named's process and cache gauges.
docs/metrics.md has example queries and alerts checked with promtool.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/config/config_test.go

@@ -87,3 +87,31 @@ func TestStatsConfig(t *testing.T) {
 		}
 	}
 }
+
+func TestMetricsConfig(t *testing.T) {
+	d := Default()
+	if d.Metrics.Enabled || len(d.Metrics.AllowPrefixes()) != 2 || d.Metrics.Token != "" {
+		t.Errorf("defaults = %+v", d.Metrics)
+	}
+	path := filepath.Join(t.TempDir(), "jarl.yaml")
+	for _, tc := range []struct {
+		yaml string
+		ok   bool
+	}{
+		{"metrics: {enabled: true}", true},
+		{"metrics: {enabled: true, listen: [\"0.0.0.0:9450\", \"[::]:9450\"], allow: [10.0.0.5, 192.168.1.0/24]}", true},
+		{"metrics: {enabled: true, allow: [], token: 0123456789abcdef}", true},
+		{"metrics: {enabled: true, allow: []}", false}, // nobody could scrape
+		{"metrics: {enabled: true, token: short}", false},
+		{"metrics: {enabled: true, token: \"has space 0123456789\"}", false},
+		{"metrics: {enabled: true, listen: [\"9450\"]}", false},
+		{"metrics: {enabled: true, allow: [prometheus.lan]}", false},
+		{"metrics: {enabled: false, listen: [nonsense]}", true}, // only checked when enabled
+	} {
+		os.WriteFile(path, []byte(tc.yaml+"\n"), 0o644)
+		_, err := Load(path, false)
+		if (err == nil) != tc.ok {
+			t.Errorf("%s: err = %v, want ok=%v", tc.yaml, err, tc.ok)
+		}
+	}
+}