Define an authentication policy for /metrics

[tnull]

Summary

Any request whose path is exactly /metrics receives a health metric before
authorization is checked. This makes service liveness and the protocol version
header available to unauthenticated network clients.

Observed on 88a5703496386465556d920dccf49512296c53d0 (current main). The
endpoint was intentionally added by #98/#99, so this issue is about clarifying
and enforcing its intended exposure policy rather than removing health checks.

Impact

Low-severity reconnaissance: an unauthenticated client can determine whether a
VSS instance is reachable/up and retrieve its protocol version header. If more
metrics are added later, the same pre-auth short-circuit may expose operational
details unintentionally.

Code evidence

server/src/vss_service.rs:82-92 returns the metrics response before
handle_request invokes Authorizer::verify.

Proof of concept

curl -i http://SERVER:8080/metrics

This returns 200 OK, vss_service_up 1, and the protocol version without an
Authorization header.

Suggested remediation

• Document that /metrics is intentionally public and must be network-restricted,
  or require authorization for it.
• Consider a separate management listener/bind address for health and metrics.
• Add a test that pins the chosen exposure policy before expanding the payload.

Reported by Bitcoin Red Team.