Keep the metrics entry at the top of Completed Steps

The rebase onto next placed the entry for this change below the one
next gained meanwhile; the TODO.md workflow puts a finished step at
the top.

Model: opus-5-5

TODO.md

@@ -40,6 +40,15 @@ P2: security: per-origin rate limiting
   not in the cache is made from the cached source when there is one. `README.md`
   says so under `/v1/image/`. A refusal from the negative cache now counts as a
   miss, as any other request that misses the variant cache does.
+- 2026-10-15 the request metrics are labelled by route, not by path (closes
+  #254): their `handler` label was each request's path, so every new path, a 404
+  or an encrypted URL, added series to the Prometheus registry that were never
+  removed, and `/metrics` listed every encrypted URL's token. The label is now
+  the pattern of the chi route the request matches, such as `/v1/image/*`, or
+  `unmatched` for a request that matches none: one the router answers 404 or
+  405, or a CORS preflight. The metrics library takes the label before the
+  request is routed, so the metrics middleware asks the router which route
+  matches.
 - 2026-10-15 the host of a `/v1/image/` URL is lower-cased, and one with a port
   needs a signature (closes #246): with `cdn.example.com` allowlisted,
   `CDN.Example.com` and `cdn.example.com:8443` passed the allowlist too, and
@@ -51,15 +60,6 @@ P2: security: per-origin rate limiting
   not in `allowlist.IsAllowed`, which also matches `referer_blocklist`, where a
   `Referer` is blocked whatever its port. A URL is signed over its host as it
   writes it, in lower case, with any IPv6 brackets, `:` and port kept.
-- 2026-10-15 the request metrics are labelled by route, not by path (closes
-  #254): their `handler` label was each request's path, so every new path, a 404
-  or an encrypted URL, added series to the Prometheus registry that were never
-  removed, and `/metrics` listed every encrypted URL's token. The label is now
-  the pattern of the chi route the request matches, such as `/v1/image/*`, or
-  `unmatched` for a request that matches none: one the router answers 404 or
-  405, or a CORS preflight. The metrics library takes the label before the
-  request is routed, so the metrics middleware asks the router which route
-  matches.
 - 2026-10-15 a `:` in the source path or query no longer moves where the path
   ends and the query begins (closes #247): the signed data and the cache key
   joined host, path and query with `:` and no escaping, so a URL signed for