sneak
c172deee72
All checks were successful
check / check (push) Successful in 4m49s
METRICS_USERNAME alone mounted /metrics behind a credential map whose only password was the empty string, so `curl -u 'metrics:'` returned 200 while the startup log reported hasMetricsAuth:false. The route mount tested the username and the log tested both, so the two could disagree about whether the endpoint existed. Config.MetricsAuthEnabled is now the single value behind both: the /metrics mount, the Prometheus recording middleware and the startup log's hasMetricsAuth field all read it, and it requires both credentials. loadFromEnv rejects a half-set pair outright with an error naming both variables in either direction, so a set-but-invalid configuration aborts startup rather than degrading into an endpoint the operator did not ask for. Both unset stays valid and leaves /metrics unmounted. Tests cover all four combinations at the config layer, counting "set to the empty string" and "not set at all" as separate inputs, plus the route tree's behaviour in each state.