OpenMetrics endpoint: no-unique-creds scrape path (Alloy auth model)

**Hard constraint from the monitoring/collector-fleet side (Chris Nelson, 2026-07-15 + acceptance-criteria follow-up 2026-07-20).** Promoted from the #1636 comments into a tracked sub-issue so the auth model is an explicit, un-skippable design decision. This is the **single design choice that keeps the shell+jq replication sidecar alive** if we get it wrong.

## Requirement
An Alloy collector must be able to scrape `/metrics` **without unique-per-host credentials.**

Two shapes satisfy this; either is acceptable:
1. **Loopback-only, no auth (preferred):** serve `/metrics` on the operations port (or a dedicated metrics port) bound to loopback — the same trust model the current replication sidecar already uses (authless ops UDS, loopback listener). Works on both cohorts today (fabric host-network containers + legacy on-host Alloy).
2. **Fleet-uniform credentials:** one non-unique credential/role that CM + ansible provision identically on every host (like the existing `metrics_scraper` role CM already provisions for the desired-state feed).

**What does not work:** app-port auth with a distinct secret per host — that is 250+ unique secrets to 250+ collectors, and it is the reason the sidecar would survive this endpoint shipping.

## Acceptance criteria
- `/metrics` is scrapable by Alloy with **no per-host-unique credential** (via shape 1 or 2 above).
- The auth model is documented as an explicit decision on the endpoint.

Rollout note (from monitoring): the existing sidecar runs in parallel per cohort for parity verification before anything is deleted; the no-unique-creds requirement is the only hard gate.

---
🤖 Filed by KrAIs on behalf of Kris.

Start by tracing the existing `/metrics` endpoint and the replication sidecar's auth path; compare the loopback or operations-port option with the fleet-uniform `metrics_scraper` provisioning path in CM and Ansible. Done means Alloy can scrape `/metrics` without per-host-unique credentials and the chosen auth model is documented on the endpoint.

Written by the indexing model from the issue text.