feat(ops): protect metrics, rate-limit auth, agent secret timing, e2e smoke

Bearer для /metrics (EVOBGP_METRICS_TOKEN); rate limit /v1/auth/config; constant-time agent secret; OTel stub; Playwright smoke; HTTP_PROXY note; checklist обновлён.

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/httpclient/httpclient.go

@@ -14,6 +14,7 @@ import (
 const DefaultTimeout = 45 * time.Second
 
 // New returns an HTTP client with timeout and tuned idle connection pooling.
+// Standard proxy env (HTTP_PROXY / HTTPS_PROXY / NO_PROXY) is honored via the cloned DefaultTransport.
 func New(timeout time.Duration) *http.Client {
 	if timeout <= 0 {
 		timeout = DefaultTimeout