Add production condition retrieval smoke test

apps/ai-service/main.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+from hmac import compare_digest
 from time import perf_counter
 from typing import Any
 
@@ -89,7 +90,23 @@ def create_app(
         return Response(content='{"status":"ready"}', media_type="application/json")
 
     @app.get("/metrics")
-    def prometheus_metrics() -> Response:
+    def prometheus_metrics(request: Request) -> Response:
+        # Optional bearer token. Today this endpoint is unreachable from the
+        # internet — Caddy proxies only `web`, and ai-service publishes no
+        # host port — so an unset token keeps local development and the
+        # current compose scrape working unchanged. It stops being safe the
+        # moment the service is exposed through an Ingress, which the Helm
+        # chart now makes possible, so the guard lives here rather than in
+        # whichever deployment happens to expose it first.
+        expected = configured.metrics_token
+        if expected:
+            supplied = request.headers.get("authorization", "")
+            prefix = "Bearer "
+            token = supplied[len(prefix):] if supplied.startswith(prefix) else ""
+            # Constant-time compare: a scrape token is a shared secret, and
+            # `==` on a secret leaks its prefix through timing.
+            if not compare_digest(token, expected):
+                return Response(status_code=401)
         exporter = getattr(app.state, "metrics", None)
         if exporter is None or not hasattr(exporter, "render"):
             # 404 rather than an empty 200: a scrape that silently succeeds
@@ -103,7 +120,10 @@ def create_app(
 
 
 def _route_label(path: str) -> str:
-    known = {"/health", "/ready", "/metrics", "/v1/rag/query", "/v1/rag/suggest"}
+    known = {
+        "/health", "/ready", "/metrics", "/v1/rag/query", "/v1/rag/suggest",
+        "/v1/rag/feedback",
+    }
     return path if path in known else "other"