Metrics taps: node_exporter + cAdvisor containers, MediaMTX and Caddy metrics on loopback (Prometheus format, store-agnostic)

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

configure.py

@@ -303,7 +303,13 @@ groups: {{http.request.header.X-Authentik-Groups}}"
 {CADDY_LOG}	reverse_proxy 127.0.0.1:8096
 }}
 """
-    Path("Caddyfile").write_text(f"""# vanguard:main
+    Path("Caddyfile").write_text(f"""{{
+	servers {{
+		metrics                           # Prometheus metrics at http://127.0.0.1:2019/metrics (LOGGING.md)
+	}}
+}}
+
+# vanguard:main
 {domain} {{
 	encode zstd gzip
 {gate_any}	# who does Authentik say I am? (debug: shows exactly the identity headers the apps receive)
@@ -393,7 +399,8 @@ rtspAddress: 127.0.0.1:8554
 rtspTransports: [tcp]
 rtspEncryption: "no"
 moq: no
-metrics: no
+metrics: yes                     # Prometheus text format for whichever metrics store is chosen (LOGGING.md); loopback only
+metricsAddress: :9998
 pprof: no
 
 # live portal (served to the browser only via Caddy + Authentik on live.HOST; these ports are published on 127.0.0.1)