Prometheus metrics (absent when OHS_METRICS=false)

Instance wide counters, never per-tenant data. On the API listener a scrape presents the OHS_METRICS_TOKEN bearer token; with no token configured every scrape is refused with 403. With OHS_METRICS_LISTEN set the route moves to that address (404 here), where the token is asked for only when set.