push ci run metrics to victoriametrics, with a grafana board

A swarm-ci-metrics host unit on a 5-minute timer lists every forge
repo's Actions runs as the new read-only ci-metrics account and pushes
each finished run's duration and queue wait over OTLP, stamped at the
run's stop time. The first pass backfills from run 1. swarm-controller
mints the account's token into bao and keeps a ci-metrics team with
read on the Actions unit in every organisation.

Closes #5376

swarm-ci-metrics/Cargo.toml

@@ -0,0 +1,35 @@
+[package]
+name = "swarm-ci-metrics"
+version.workspace = true
+edition.workspace = true
+
+[[bin]]
+name = "swarm-ci-metrics"
+path = "src/main.rs"
+
+[dependencies]
+anyhow.workspace = true
+# The runs list and the repo search, as the `ci-metrics` account.
+forgejo-api.workspace = true
+hive-log.workspace = true
+# The OTLP/HTTP push. Built by hand rather than through the OTel SDK, whose
+# readers stamp every point with the export time, not the run's `stopped`.
+reqwest.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+# The OIDC client-credentials mint, and the rustls provider.
+swarm-queue-client.workspace = true
+# The forge token and client secret paths, and the store login.
+swarm-secret-client.workspace = true
+# The run timestamps `forgejo-api` hands back.
+time.workspace = true
+tokio.workspace = true
+tracing.workspace = true
+url.workspace = true
+
+[dev-dependencies]
+# A scratch state directory for the cursor tests.
+tempfile = "3"
+
+[lints]
+workspace = true