Serve Prometheus metrics at /metrics behind basic auth (closes #94)

With METRICS_USERNAME and METRICS_PASSWORD both set, the backend
records request metrics through go-http-metrics and serves them at
GET /metrics behind basic auth with those credentials; nginx passes
/metrics to it. With neither set there is no such route; one alone
stops the start with an error naming both.

Only requests chi has matched to a route are recorded, not every
request as the conventions show: the labels are path and method, which
clients can make up without end. So POST /api/v1/reports is registered
by its full path, not inside a route group.

Deviation: go get and go mod tidy ran directly; no entrypoint adds a Go
dependency yet (#45).

Model: opus-5-5

nginx.conf

@@ -68,4 +68,10 @@ server {
     location = /.well-known/healthcheck {
         proxy_pass http://127.0.0.1:8081;
     }
+
+    # The backend's Prometheus metrics, behind its own basic auth. Unless
+    # METRICS_USERNAME and METRICS_PASSWORD are set, it answers 404.
+    location = /metrics {
+        proxy_pass http://127.0.0.1:8081;
+    }
 }