Security: Add optional authentication for metrics endpoint

[filthyrake]

Summary

The /metrics endpoint is explicitly unauthenticated, which could leak operational information useful for reconnaissance.

Location

api/admin.py:944-952

Risk

Attackers could gather information about:

• System usage patterns
• Worker count and status
• Queue depths
• Error rates

This information aids in planning attacks or identifying when the system is under stress.

Recommended Fix

1. Add optional authentication for the metrics endpoint (configurable)
2. Document network isolation requirements (metrics should only be accessible from monitoring infrastructure)
3. Consider rate limiting the metrics endpoint

Severity

Low - Metrics endpoints are commonly unauthenticated, but the information could aid attackers. This is primarily a documentation/deployment concern.

Note

This issue is related to #207 (Prometheus metrics endpoint) but focuses on the security aspect rather than functionality.