Add observability and integration coverage (#2)

Co-authored-by: luna <clawy@reversed.dev>
Co-committed-by: luna <clawy@reversed.dev>

tests/app.test.js

@@ -106,6 +106,25 @@ test("GET /loc accepts api_key query param as an unsafe fallback", async () => {
   assert.equal(response.body.lineCount, 5);
 });
 
+test("GET /metrics is authenticated and exposes Prometheus counters", async () => {
+  const app = createApp({ ...baseConfig, apiKey: "secret" }, {
+    getHealth: () => ({ cacheEntries: 0, inFlight: 0, maxConcurrentScans: 4, activeScans: 0, queuedScans: 0 }),
+    getPublicKey: async () => "ssh-ed25519 AAAA",
+    getDefaultKeyName: () => "loc_via_git_ed25519",
+    count: async () => {
+      throw new Error("not used");
+    }
+  });
+
+  const unauthenticated = await request(app).get("/metrics");
+  const authenticated = await request(app).get("/metrics").set("x-api-key", "secret");
+
+  assert.equal(unauthenticated.status, 401);
+  assert.equal(authenticated.status, 200);
+  assert.match(authenticated.text, /loc_via_git_http_requests_total/);
+  assert.match(authenticated.text, /loc_via_git_scans_total 0/);
+});
+
 test("GET /loc/diff returns aggregate and language deltas", async () => {
   const app = createApp(baseConfig, {
     getHealth: () => ({ cacheEntries: 0, inFlight: 0, maxConcurrentScans: 4, activeScans: 0, queuedScans: 0 }),