config: a metrics username without a password stops startup (closes #268)

DNSWATCHER_METRICS_USERNAME turns on /metrics, and its Basic Auth used
DNSWATCHER_METRICS_PASSWORD as it was, empty included, so the username
with an empty password got in. config.New now refuses a username
without a password with ErrNoMetricsPassword, whose message names both
variables. The README's variable table says the password is required
with the username.

Judgement call: the check is in New, after buildConfig, since it
compares two settings buildConfig has already read; buildConfig is
also at the linter's length limit.

Model: opus-5-5

internal/config/config_test.go

@@ -354,6 +354,24 @@ func TestNew_SkipRecordNotificationsNotInTargetsStopsStartup(t *testing.T) {
 	require.ErrorContains(t, err, `"www.example.net"`)
 }
 
+// TestNew_MetricsUsernameWithoutPasswordStopsStartup checks an unset and an
+// empty password; TestNew_EnvironmentOverrides checks a username with one.
+func TestNew_MetricsUsernameWithoutPasswordStopsStartup(t *testing.T) {
+	viper.Reset()
+	t.Setenv("DNSWATCHER_TARGETS", "example.com")
+	t.Setenv("DNSWATCHER_METRICS_USERNAME", "prom")
+
+	_, err := config.New(nil, newTestParams(t))
+	require.ErrorIs(t, err, config.ErrNoMetricsPassword, "password unset")
+	require.ErrorContains(t, err, "DNSWATCHER_METRICS_PASSWORD")
+
+	viper.Reset()
+	t.Setenv("DNSWATCHER_METRICS_PASSWORD", "")
+
+	_, err = config.New(nil, newTestParams(t))
+	require.ErrorIs(t, err, config.ErrNoMetricsPassword, "password empty")
+}
+
 func TestNew_CustomDNSIntervalDuration(t *testing.T) {
 	viper.Reset()
 	t.Setenv("DNSWATCHER_TARGETS", "example.com")