feat(controller): serve Prometheus fleet metrics

[devmittal02]

Closes #183.

What

Adds an opt-in metricsListen controller setting. When set, the controller serves GET /metrics (Prometheus text format) on that address. Unset (the default) changes nothing.

metricsListen: 0.0.0.0:9090

Why

Fleet health is only visible through the management UI today. adminListen must stay on loopback, so a scraper cannot reach it. Operators running a metrics stack (Prometheus, Grafana Alloy, and similar) have no way to alert on stale devices, failed configuration applies, or devices lagging behind the active configuration revision. The usage reporting from #160 covers tokens and cost, not fleet health.

Metrics

Metric	Type
agentdesktop_build_info{version}	gauge
agentdesktop_devices	gauge
agentdesktop_devices_online	gauge (seen in last 90s, same threshold as the UI overview)
agentdesktop_devices_connected	gauge (open streams on this replica)
agentdesktop_device_oldest_seen_age_seconds	gauge
agentdesktop_devices_by_version{os,agent_version}	gauge
agentdesktop_devices_by_config_state{state}	gauge (applied, failed, unreported)
agentdesktop_devices_config_behind	gauge
agentdesktop_config_active_revision	gauge
agentdesktop_inventory_mcp_servers	gauge
agentdesktop_inventory_skills	gauge
agentdesktop_telemetry_events_total{type}	counter
agentdesktop_device_message_errors_total	counter

Fleet state is read from the database at scrape time, so it is correct after a restart. The connected gauge and the two counters are in memory and start from zero on restart, as Prometheus counters do. With several replicas those are per replica and should be summed.

Privacy

Label values come from closed sets, or from the OS and agent version of enrolled devices. Hostnames, users, device IDs, MCP server names, and tool inputs are never exported. scrape_reports_fleet_state_without_identifying_labels asserts that.

Design notes

• A separate listener instead of a route on the admin server, because the admin listener is required to be loopback and has no authentication of its own.
• The endpoint is unauthenticated, like most exporters. The config comment and README say to expose it only to the scraper.
• insert_telemetry now returns the stored event type so the counter uses the same value that is persisted.
• No new dependencies. The text format is written by hand, since the output is small and fixed.

Testing

• cargo test -p agentdesktop-core -p agentdesktop-controller passes, including a scrape test against a SQLite database and a config test for the new field.
• cargo clippy -p agentdesktop-controller -p agentdesktop-core --all-targets -- -D warnings and cargo fmt --all --check are clean.
• I did not build the desktop app crate, which needs its own frontend build and is not touched here.
• Not tested: an end-to-end scrape against a running controller with real devices.

Draft while I get feedback on the metric names and on whether you would rather expose this through an OpenTelemetry exporter.

🤖 Generated with Claude Code

[devmittal02]

@peterj could you take a look when you have a moment? This is the implementation for #183. It is still a draft, mainly to get your view on the metric names, the separate metricsListen listener, and the open questions listed in the issue. Thanks!