Expose Prometheus metrics on a separate port

Metrics are served on METRICS_PORT (default 2112, "off" to disable), never on
the public port. Besides the Go runtime and process metrics this adds:

- http_requests_total and http_request_duration_seconds per route pattern,
  from an Echo middleware.
- musicserver_songs_requested_total and musicserver_songs_played_total by
  pick mode (random, low, classic). The mode is now stored with each queued
  song (migration 000006, not released yet).
- Library size, sync duration, last successful sync, broken songs from the
  last full sync, and the database connection pool.

Refs #35, #36, #37

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/config/config.go

@@ -17,6 +17,9 @@ const DefaultReleasesURL = "https://gitea.sanplex.xyz/api/v1/repos/sansan/MusicP
 // Config holds all settings read from the environment.
 type Config struct {
 	Port int
+	// MetricsPort serves Prometheus metrics on a port of its own, so /metrics is never
+	// reachable through the public port. 0 means metrics are not served.
+	MetricsPort int
 
 	DBHost     string
 	DBPort     string
@@ -77,6 +80,11 @@ func load(getenv func(string) string) (Config, error) {
 	}
 	cfg.Port = port
 
+	cfg.MetricsPort, err = parseMetricsPort(getenv("METRICS_PORT"))
+	if err != nil {
+		errs = append(errs, fmt.Errorf("METRICS_PORT: %w", err))
+	}
+
 	for name, value := range map[string]string{
 		"DB_HOST":         cfg.DBHost,
 		"DB_PORT":         cfg.DBPort,
@@ -120,6 +128,24 @@ func parseCIDRs(value string) ([]*net.IPNet, error) {
 	return nets, nil
 }
 
+// DefaultMetricsPort is used when METRICS_PORT is not set.
+const DefaultMetricsPort = 2112
+
+// parseMetricsPort reads METRICS_PORT: empty for the default, "off" for no metrics, or a port.
+func parseMetricsPort(value string) (int, error) {
+	switch value {
+	case "":
+		return DefaultMetricsPort, nil
+	case "off":
+		return 0, nil
+	}
+	port, err := strconv.Atoi(value)
+	if err != nil || port < 1 || port > 65535 {
+		return 0, fmt.Errorf("%q is not a port or \"off\"", value)
+	}
+	return port, nil
+}
+
 // parseOrigins parses a comma-separated list of origins (scheme://host[:port], nothing else).
 func parseOrigins(value string) ([]string, error) {
 	var origins []string

internal/config/config_test.go

@@ -32,6 +32,26 @@ func TestLoadDefaults(t *testing.T) {
 	assert.Equal(t, DefaultReleasesURL, cfg.ReleasesURL)
 	assert.Empty(t, cfg.TrustedProxies)
 	assert.Empty(t, cfg.CORSAllowedOrigins)
+	assert.Equal(t, DefaultMetricsPort, cfg.MetricsPort)
+}
+
+func TestLoadMetricsPort(t *testing.T) {
+	values := validEnv()
+	values["METRICS_PORT"] = "9100"
+	cfg, err := load(env(values))
+	require.NoError(t, err)
+	assert.Equal(t, 9100, cfg.MetricsPort)
+
+	values["METRICS_PORT"] = "off"
+	cfg, err = load(env(values))
+	require.NoError(t, err)
+	assert.Zero(t, cfg.MetricsPort)
+
+	for _, invalid := range []string{"abc", "0", "70000", "-1", "OFF"} {
+		values["METRICS_PORT"] = invalid
+		_, err = load(env(values))
+		assert.ErrorContains(t, err, "METRICS_PORT", invalid)
+	}
 }
 
 func TestLoadMissingRequired(t *testing.T) {