metrics: rate limit /metrics per client address before Basic Auth (closes #101)

/metrics is behind a password, and REPO_POLICIES.md requires rate
limiting on password logins. Each client address may now send it 30
requests a minute, counted by httprate before Basic Auth, so failed
logins use up the allowance and a request over it gets 429 without
the password being checked. The address is the one the existing
trusted-proxy logic in internal/middleware works out, with IPv6
addresses grouped by /64; an IPv4 address a proxy reports in
IPv6-mapped form counts as the plain IPv4 address. A Prometheus
server scraping every 15 seconds sends 4 requests a minute.

Model: opus-5-5

TODO.md

@@ -20,6 +20,8 @@ https://git.eeqj.de/sneak/dnswatcher/issues/104
 
 # Completed Steps
 
+- 2026-10-01: `/metrics` allows each client address 30 requests a minute,
+  counted before Basic Auth, and answers 429 beyond that (closes #101).
 - 2026-10-01: the image built by `make docker` reports the `git describe`
   version, not `dev`, and the startup log now shows it (closes #109).
 - 2026-10-01: two notify shutdown tests always release the delivery they hold,
@@ -97,8 +99,6 @@ https://git.eeqj.de/sneak/dnswatcher/issues/104
   https://git.eeqj.de/sneak/dnswatcher/issues/107
 - invalid DNS or TLS interval silently replaced by the default:
   https://git.eeqj.de/sneak/dnswatcher/issues/177
-- rate limit on `/metrics` Basic Auth:
-  https://git.eeqj.de/sneak/dnswatcher/issues/101
 - trial run of the finished image:
   https://git.eeqj.de/sneak/dnswatcher/issues/149
 - 1.0 readiness: run it with a real config and read the logs: