docs(server): clarify metrics authentication behavior

pkg/server/server.go

@@ -60,8 +60,9 @@ func New(
 	authed.POST("/map/:mapping/v1/embeddings", h.openAIEmbeddingsMapped)
 	authed.POST("/map/:mapping/v1/models/*modelaction", h.googleDispatchMapped)
 
-	// Metrics — only when enabled; registered in the authed group so server
-	// auth (if configured) applies. Metrics may additionally enforce its own key.
+	// Metrics — only when enabled.
+	// If metrics.api_key is set, routes are guarded by that key (on the authed group).
+	// If metrics.api_key is blank, routes are public — no auth headers checked at all.
 	if cfg.Metrics.Enabled {
 		metricsHandler := promhttp.HandlerFor(reg.Prometheus(), promhttp.HandlerOpts{})
 		path := cfg.Metrics.Path
@@ -73,11 +74,11 @@ func New(
 			authed.GET(path, metricsAuthHandler(cfg.Metrics.APIKey, metricsHandler))
 			authed.GET("/dashboard", metricsKeyMiddleware(cfg.Metrics.APIKey, dash))
 		} else {
-			authed.GET(path, func(w http.ResponseWriter, req bunrouter.Request) error {
+			router.GET(path, func(w http.ResponseWriter, req bunrouter.Request) error {
 				metricsHandler.ServeHTTP(w, req.Request)
 				return nil
 			})
-			authed.GET("/dashboard", dash)
+			router.GET("/dashboard", dash)
 		}
 	}