move client-cert gauges behind an otel feature of swarm-secret-client, drop the crate

swarm-secret-client/Cargo.toml

@@ -13,6 +13,9 @@ futures-util.workspace = true
 # the `BAO_*` files) rather than by its env defaults, so the dependency is
 # direct rather than incidental.
 reqwest.workspace = true
+# `cert_metrics`: the `bao.client_cert.*` gauges, for the services that export
+# OTLP. Off by default so the other dependents link no OTel.
+opentelemetry = { workspace = true, optional = true }
 # vaultrs's own endpoint machinery, for the one endpoint it does not
 # implement — see `client::WriteAclPolicy`.
 rustify.workspace = true
@@ -40,6 +43,8 @@ workspace = true
 # provider compiled in rustls picks it without an install, so the provider
 # test would pass with `install_crypto_provider` doing nothing.
 [dev-dependencies]
+# `InMemoryMetricExporter`, to read back what `cert_metrics` exports.
+opentelemetry_sdk = { workspace = true, features = ["testing"] }
 rustls = { workspace = true, features = ["ring"] }
 # `test-util` for `#[tokio::test(start_paused = true)]`: the re-read backoff
 # tests run on paused time.
@@ -47,3 +52,6 @@ tokio = { workspace = true, features = ["test-util"] }
 # Capturing what a re-read logs, to check it names the client and never the
 # secret.
 tracing-subscriber.workspace = true
+
+[features]
+otel = ["dep:opentelemetry"]