feat(ops): protect metrics, rate-limit auth, agent secret timing, e2e smoke

Bearer для /metrics (EVOBGP_METRICS_TOKEN); rate limit /v1/auth/config; constant-time agent secret; OTel stub; Playwright smoke; HTTP_PROXY note; checklist обновлён.

Co-authored-by: Cursor <[email protected]>

internal/observability/metrics_auth.go

@@ -0,0 +1,32 @@
+package observability
+
+import (
+	"crypto/subtle"
+	"net/http"
+	"os"
+	"strings"
+)
+
+// ProtectMetrics wraps the Prometheus handler. When EVOBGP_METRICS_TOKEN is set,
+// scrapes must send Authorization: Bearer <token> (constant-time compare).
+// Empty token keeps /metrics open (dev / private network).
+func ProtectMetrics(next http.Handler) http.Handler {
+	token := strings.TrimSpace(os.Getenv("EVOBGP_METRICS_TOKEN"))
+	if token == "" {
+		return next
+	}
+	want := []byte(token)
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		h := r.Header.Get("Authorization")
+		const p = "Bearer "
+		got := ""
+		if strings.HasPrefix(h, p) {
+			got = strings.TrimSpace(h[len(p):])
+		}
+		if subtle.ConstantTimeCompare([]byte(got), want) != 1 {
+			http.Error(w, "Unauthorized", http.StatusUnauthorized)
+			return
+		}
+		next.ServeHTTP(w, r)
+	})
+}

internal/observability/otel.go

@@ -0,0 +1,21 @@
+package observability
+
+import (
+	"context"
+	"os"
+	"strings"
+
+	"evobgp/internal/logging"
+)
+
+// StartOTelIfEnabled is an opt-in stub for OpenTelemetry (EVOBGP_OTEL_ENDPOINT).
+// Full exporter wiring lands when the ops stack provides a collector; this logs intent only.
+func StartOTelIfEnabled(ctx context.Context) (shutdown func(context.Context) error) {
+	ep := strings.TrimSpace(os.Getenv("EVOBGP_OTEL_ENDPOINT"))
+	if ep == "" {
+		return func(context.Context) error { return nil }
+	}
+	logging.Default().Info("otel opt-in enabled (stub; export not wired yet)", "endpoint", ep)
+	_ = ctx
+	return func(context.Context) error { return nil }
+}