Serve Prometheus metrics behind SWWAF_METRICS_TOKEN (closes #23)

GET /_smallwebwaf/metrics answers in the Prometheus text format for a
request carrying SWWAF_METRICS_TOKEN, 401 without it and 404 while it is
unset. Every request under /_smallwebwaf/ but the health check now goes
through the checks and is answered where it would be forwarded, 404 for
any path but the metrics, so none reaches the app. In the client's
history a 401 counts as refused, the metrics and the 404s as neither.
SWWAF_METRICS_TOP_N bounds the series by country, the rest counted as
other.

Deviation: go.mod and go.sum written by hand, as go runs only through
make.
Deviation: no metrics yet for state files read again after an edit or
edits set aside; that work is not merged.

Model: opus-5-5

internal/bans/bans.go

@@ -112,6 +112,8 @@ type Ledger struct {
 	netblocks *simplelru.LRU[netip.Prefix, *[]Ban]
 	// held is how many bans netblocks holds, at most rules.MaxBans.
 	held int
+	// made is how many bans BanForLimit has made since the start.
+	made int
 	// v4Lengths and v6Lengths are the lengths of the IPv4 and IPv6
 	// netblocks that have been banned. Check looks for a ban at each of
 	// them, so that a ban read from bans.json refuses every client in its
@@ -206,6 +208,7 @@ func (l *Ledger) BanForLimit(netblock netip.Prefix, now time.Time, notes Notes)
 		Notes:    notes,
 	}
 	l.add(ban)
+	l.made++
 
 	select {
 	case l.changed <- struct{}{}:
@@ -229,6 +232,38 @@ func (l *Ledger) Bans(netblock netip.Prefix) []Ban {
 	return slices.Clone(*bans)
 }
 
+// Made returns how many bans the ledger has made since the start; bans
+// read from bans.json are not among them.
+func (l *Ledger) Made() int {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+
+	return l.made
+}
+
+// Count returns how many of the bans held are active at now, and how many
+// are permanent.
+func (l *Ledger) Count(now time.Time) (int, int) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+
+	active, permanent := 0, 0
+
+	for _, bans := range l.netblocks.Values() {
+		for _, ban := range *bans {
+			if ban.ActiveAt(now) {
+				active++
+			}
+
+			if ban.Permanent() {
+				permanent++
+			}
+		}
+	}
+
+	return active, permanent
+}
+
 // Snapshot returns every ban held, sorted by netblock, and each
 // netblock's bans oldest first, as bans.json lists them.
 func (l *Ledger) Snapshot() []Ban {