Serve Prometheus metrics at /metrics behind basic auth (closes #94)

With METRICS_USERNAME and METRICS_PASSWORD both set, the backend
records request metrics through go-http-metrics in a registry of its
own, with Go's runtime and process metrics, and serves them at
GET /metrics behind basic auth with those credentials; nginx passes
/metrics to it. With neither set there is no such route; one alone
stops the start with an error naming both, and a METRICS_USERNAME
containing ":" stops it with an error naming that.

Only requests that reach the health check or POST /api/v1/reports are
recorded, not every request as the conventions show: the labels are
path and method, which clients can make up without end. So
POST /api/v1/reports is registered by its full path, not inside a
route group.

Deviation: go get and go mod tidy ran directly; no entrypoint adds a Go
dependency yet (#45).

Model: opus-5-5

nginx.conf

@@ -68,4 +68,10 @@ server {
     location = /.well-known/healthcheck {
         proxy_pass http://127.0.0.1:8081;
     }
+
+    # The backend's Prometheus metrics, behind its own basic auth. Unless
+    # METRICS_USERNAME and METRICS_PASSWORD are set, it answers 404.
+    location = /metrics {
+        proxy_pass http://127.0.0.1:8081;
+    }
 }