swarm-victoriametrics: forward only the store's read API

The metrics vhost's `/` proxied every path to VictoriaMetrics with no
auth_request, so anything that could reach metrics.<swarm> could write
(`/api/v1/import`, `/api/v1/write`, ...) and delete
(`/api/v1/admin/tsdb/delete_series`) series. Only the OTLP push route
was gated.

`/` now answers 403. The read routes Grafana's Prometheus datasource
and vmui use are forwarded by exact or `^~` prefix location, each with
the matched path as its proxy_pass URI. The bare domain, which the
swarm UI's Metrics quick link opens, redirects to vmui instead of the
store's index page. The OTLP push location is unchanged.

Closes #5186

nix/module-eval/core-toggle.nix

@@ -425,6 +425,38 @@ let
         && !(lib.hasInfix "error_page" l)
         && lib.hasInfix "error_page" browser;
     }
+    {
+      # The store authenticates nothing itself, so every location that
+      # forwards without `auth_request` is open to anything that can reach the
+      # domain. The query location is the positive control: it shows the
+      # filter finds forwarding locations at all.
+      name = "the metrics vhost forwards only read paths without a credential";
+      ok =
+        let
+          locs = allLocal.services.nginx.virtualHosts."metrics.t.local".locations;
+          open = lib.filterAttrs (
+            _: l:
+            l.proxyPass != null
+            && !(lib.hasInfix "auth_request" l.extraConfig)
+            && !(lib.hasInfix "internal;" l.extraConfig)
+          ) locs;
+          writeWords = [
+            "import"
+            "write"
+            "admin"
+            "delete"
+            "insert"
+            "internal"
+            "push"
+            "prometheus"
+            "influx"
+          ];
+        in
+        locs."/".proxyPass == null
+        && locs."/".return == "403"
+        && open ? "= /api/v1/query"
+        && lib.all (n: n != "/" && !(lib.any (w: lib.hasInfix w n) writeWords)) (lib.attrNames open);
+    }
     {
       # The read counterpart to the ingest location: an agent queries the log
       # store with a bearer token, and the `/` catch-all is the browser's