Prometheus metrics at /metrics, configured in jarl.yaml

New metrics: section (enabled, listen, allow, token). /metrics is served on
the main listeners, the local socket (root and jarld's user) and optional
metrics-only addresses; a scrape needs an allowed address or the bearer
token. Exports health (named up, problems, drift, backups, blocklists,
DNSSEC phases, token expiry) and, with stats on, named's and Jarl's query
counters since jarld started plus named's process and cache gauges.
docs/metrics.md has example queries and alerts checked with promtool.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/e2e.sh

@@ -13,7 +13,7 @@ set -u
 ROOT=$(cd "$(dirname "$0")/.." && pwd)
 WORK=${WORK:-$(mktemp -d /tmp/jarl-e2e.XXXXXX)}
 E=$WORK
-DNS=${DNS_PORT:-25353}; CTL=${CTL_PORT:-25953}; HTTP=${HTTP_PORT:-28053}; LISTS=${LISTS_PORT:-28054}
+DNS=${DNS_PORT:-25353}; CTL=${CTL_PORT:-25953}; HTTP=${HTTP_PORT:-28053}; LISTS=${LISTS_PORT:-28054}; METRICS=${METRICS_PORT:-28055}
 if [ -n "${JARL_BIND_ROOT:-}" ]; then
 	B=$JARL_BIND_ROOT
 	export LD_LIBRARY_PATH=$(echo $B/usr/lib/*-linux-gnu | cut -d' ' -f1)
@@ -108,6 +108,10 @@ bind:
   rndc_args: ["-k", "$E/legacy/rndc.key", "-s", "127.0.0.1", "-p", "$CTL"]
 backup:
   dir: $E/backups
+metrics:
+  enabled: true
+  listen: ["127.0.0.1:$METRICS"]
+  token: e2e-metrics-token-0123456789
 EOF
 cd $E
 echo "secret-pass-123" | $JARLD -c jarl.yaml init --password-stdin --token --nameservers ns1.adbraun.test. --contact admin@adbraun.test > init.out 2>&1 || { cat init.out; exit 1; }
@@ -561,6 +565,22 @@ run "block delete (allow rule)" 0 $J block delete ok.tracker.adbraun.test
 run "no blocking left in named.conf" 1 grep -q 'response-policy' $E/etc-jarl/named.conf
 kill $LISTS_PID 2>/dev/null; LISTS_PID=
 
+# Prometheus metrics (docs/metrics.md)
+run "metrics on the main listener" 0 curl -sf http://127.0.0.1:$HTTP/metrics
+contains "^jarl_named_up 1$"
+contains "^jarl_adopted 1$"
+contains '^jarl_problems{severity="error"} 0$'
+contains '^jarl_objects{kind="zones"} '
+run "metrics on metrics.listen" 0 curl -sf http://127.0.0.1:$METRICS/metrics
+contains "^jarl_build_info{version="
+run "metrics.listen serves nothing else" 0 curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:$METRICS/api/v1/zones
+contains "^404$"
+run "metrics with the token" 0 curl -sf -H "Authorization: Bearer e2e-metrics-token-0123456789" http://127.0.0.1:$METRICS/metrics
+run "metrics with a wrong token" 0 curl -s -o /dev/null -w '%{http_code}' -H "Authorization: Bearer wrong-token-0123456789" http://127.0.0.1:$METRICS/metrics
+contains "^401$"
+run "metrics on the socket" 0 curl -sf --unix-socket $SOCK http://jarl/metrics
+contains "^jarl_open_changesets "
+
 run "status at the end" 0 $J status
 contains "Drift:.*none"