wire the authenticated OTLP push into vcs_metrics and hive-jobq-metrics

swarm-controller/src/main.rs

@@ -1157,8 +1157,21 @@ async fn main() -> Result<()> {
     // `PeriodicReader`, so it must live as long as `main` does (which it
     // does here: this binding never goes out of scope before the process
     // exits via `axum::serve(...).await` below).
+    // Own `AuthenticatedHttpClient` instance, independent of `vcs_metrics`'s
+    // — both read the same env vars, and a client is cheap enough
+    // (one `reqwest::blocking::Client`) that sharing one across two
+    // otherwise-independent exporters isn't worth the plumbing. `Ok` becomes
+    // `Some`, `Err` becomes `None` — same "log and carry on" shape as the
+    // rest of this function's optional wiring; a controller that can't
+    // authenticate its jobq push still serves every other route.
+    let jobq_http_client = crate::vcs_metrics::authenticated_http_client()
+        .inspect_err(
+            |e| tracing::warn!(error = ?e, "otel jobq-metrics: no authenticated http client"),
+        )
+        .ok()
+        .map(|c| Box::new(c) as Box<dyn opentelemetry_http::HttpClient>);
     let _jobq_metrics_provider =
-        hive_jobq_metrics::spawn_exporter(Arc::clone(&jobq), "swarm-controller");
+        hive_jobq_metrics::spawn_exporter(Arc::clone(&jobq), "swarm-controller", jobq_http_client);
 
     // Same "log and carry on" shape as the queue/bridge/forge wiring above.
     // A controller that cannot hold a webhook secret still serves every