Test metrics auth, CORS preflight, login logging and metrics (closes #79)

New tests only. The basic auth in front of /metrics answers 401 with a
challenge without credentials or with a wrong username or password, and
lets the configured ones through. A CORS preflight request gets the same
Access-Control-Allow-Origin as a GET. A POST / whose form carries the
signing key leaves the key out of the log line. The router records
requests, and /metrics reports them, only when the metrics username is
set; that test is the one in internal/server allowed to set up the
process-wide Prometheus registry.

The pinned basicauth-go already compares the password in constant time
with crypto/subtle, so no code changes.

Model: opus-5-5

TODO.md

@@ -29,6 +29,16 @@ P2: security: referer blacklist
 
 # Completed Steps
 
+- 2026-10-04 the metrics basic auth, CORS preflight, request logging and
+  metrics recording have tests (closes #79): the basic auth in front of
+  `/metrics` answers 401 with a challenge without credentials or with a wrong
+  username or password and lets the configured ones through; a preflight
+  request gets `*` for any origin when `access_control_allow_origin` is `*` and
+  no `Access-Control-Allow-Origin` from another origin than the configured
+  one; a `POST /` carrying the signing key leaves no trace of it in the log
+  line; the router records requests, and `/metrics` reports them, only when
+  the metrics username is set. Tests only; the basic auth library already
+  compares the password in constant time.
 - 2026-10-04 shutdown stops cache eviction in progress (closes #102):
   `StartEviction` runs the eviction goroutine with its own context, which
   `StopEviction` cancels, so a pass in progress stops at its next database