feat(ops): protect metrics, rate-limit auth, agent secret timing, e2e smoke

Bearer для /metrics (EVOBGP_METRICS_TOKEN); rate limit /v1/auth/config; constant-time agent secret; OTel stub; Playwright smoke; HTTP_PROXY note; checklist обновлён.

Co-authored-by: Cursor <[email protected]>

internal/agentserver/server.go

@@ -2,6 +2,7 @@ package agentserver
 
 import (
 	"context"
+	"crypto/subtle"
 	"encoding/json"
 	"fmt"
 	"log"
@@ -157,7 +158,8 @@ func (s *Server) authorize(r *http.Request) bool {
 	if !strings.HasPrefix(h, prefix) {
 		return false
 	}
-	return strings.TrimSpace(h[len(prefix):]) == secret
+	got := strings.TrimSpace(h[len(prefix):])
+	return subtle.ConstantTimeCompare([]byte(got), []byte(secret)) == 1
 }
 
 func writeJSON(w http.ResponseWriter, status int, v any) {