feat(ops): protect metrics, rate-limit auth, agent secret timing, e2e smoke

Bearer для /metrics (EVOBGP_METRICS_TOKEN); rate limit /v1/auth/config; constant-time agent secret; OTel stub; Playwright smoke; HTTP_PROXY note; checklist обновлён.

Co-authored-by: Cursor <[email protected]>

internal/httpapi/routes.go

@@ -30,12 +30,12 @@ func (s *Server) Handler() http.Handler {
 	s.registerV1(v1)
 	wrappedV1 := http.StripPrefix("/v1", v1)
 
-	s.mux.Handle("GET /metrics", observability.MetricsHandler())
+	s.mux.Handle("GET /metrics", observability.ProtectMetrics(observability.MetricsHandler()))
 	s.mux.HandleFunc("GET /version", s.handleVersion)
 	s.mux.HandleFunc("GET /v1/health", s.handleHealth)
 	s.mux.HandleFunc("GET /v1/ready", s.handleReady)
 	s.mux.HandleFunc("GET /v1/version", s.handleVersion)
-	s.mux.HandleFunc("GET /v1/auth/config", s.handleAuthConfigPublic)
+	s.mux.HandleFunc("GET /v1/auth/config", s.withAuthRateLimit(s.handleAuthConfigPublic))
 	// Firewall subsystem moved to the standalone EvoFirewall service; see docs/firewall.md.
 	// Registered on the public mux so it wins over the "/v1/" subtree below regardless of auth.
 	s.mux.HandleFunc("/v1/firewall/", s.handleFirewallGone)