docs(cryptify): document Prometheus /metrics endpoint and X-Cryptify-Source header

[dobby-coder]

Cryptify gained a Prometheus /metrics endpoint and a new X-Cryptify-Source channel-tagging header. Neither is documented in docs/repos/cryptify.md.

Source PRs

• feat: expose Prometheus /metrics endpoint for usage dashboards cryptify#102 — feat: expose Prometheus /metrics endpoint for usage dashboards
• feat(metrics): pre-seed known channels at zero on startup cryptify#165 — feat(metrics): pre-seed known channels at zero on startup
• feat(metrics): tag cryptify uploads with X-Cryptify-Source: website postguard-website#228 — sets X-Cryptify-Source: website
• feat(metrics): tag cryptify uploads with X-Cryptify-Source: outlook postguard-outlook-addon#96 — sets X-Cryptify-Source: outlook
• feat(metrics): tag cryptify uploads with X-Cryptify-Source: thunderbird postguard-tb-addon#121 — sets X-Cryptify-Source: thunderbird

What needs to change in docs/repos/cryptify.md

1. New config option

Add a row to the configuration parameters table:

Parameter	Description	Example
metrics_scan_interval_secs	Interval in seconds for the background task that samples data_dir size and file count for the storage gauges. Defaults to 60.	60

Verify the field and default against src/config.rs on the merge commit of cryptify#102.

2. New "Metrics" section

Document the GET /metrics endpoint (Prometheus text format, unauthenticated, intended for firewall- or reverse-proxy-restricted scraping). Cover the five metrics shipped in cryptify#102:

• cryptify_uploads_total{channel} — counter, finalized uploads
• cryptify_upload_bytes_total{channel} — counter, bytes uploaded
• cryptify_storage_bytes — gauge, data_dir disk usage
• cryptify_active_files — gauge, data_dir file count
• cryptify_expired_files_total — counter, uploads purged before finalize

Note the six pre-seeded channels (website, staging-website, outlook, thunderbird, api, unknown) from cryptify#165 and why they exist (PromQL increase() baseline + dashboard visibility).

3. Channel detection / X-Cryptify-Source header

Document how the channel label is derived: explicit X-Cryptify-Source -> bearer/api-key -> Origin -> User-Agent -> unknown. Sanitized to [a-z0-9_-], max 32 chars. Mention that the official clients (website, Outlook add-in, Thunderbird add-in) now set the header explicitly so callers integrating their own client should do the same to be classified correctly.

4. API table

Add a GET /metrics row to the API surface table in this page (already present in docs/guide/architecture.md:194 and docs/repos/postguard.md:255, but not on this page).

Verification

• npx vitepress build docs must succeed.
• All five metric names and the header name must match the merge commit of cryptify#102 (src/metrics.rs, src/main.rs, api-description.yaml).

This agent will pick this up on the next worker spawn.

/dobby

[dobby-coder]

This agent is on it! Dobby is reading cryptify#102 and #165, verifying the config field, and will draft the docs update for docs/repos/cryptify.md covering the metrics endpoint, the new config option, the channel-tagging header, and the API table row. Dobby will post a plan shortly.

[dobby-coder]

Plan

Update docs/repos/cryptify.md with the metrics endpoint and channel-tagging header. All identifiers verified against the cryptify#102 / #165 merge commits (ffeedb6 and 2af3ba0).

What I'll change:

1. Configuration parameters table — add metrics_scan_interval_secs row (default 60, confirmed in src/config.rs:34,56,134). Source link pinned to 2af3ba0/src/config.rs.
2. New ## Metrics section (placed after the existing API section) — documents GET /metrics, the Prometheus text format, the unauthenticated/firewall-restricted scraping model, and the five metric names (cryptify_uploads_total, cryptify_upload_bytes_total, cryptify_storage_bytes, cryptify_active_files, cryptify_expired_files_total — all confirmed in src/metrics.rs). Includes the six pre-seeded channels from cryptify#165 and the increase() baseline rationale.
3. Channel detection — a sub-section explaining the X-Cryptify-Source priority chain: explicit header -> bearer/api-key (-> api) -> Origin (website/staging-website) -> User-Agent (outlook/thunderbird) -> unknown. Includes the [a-z0-9_-] sanitization and 32-char cap, and the note that the website/Outlook/Thunderbird clients now set the header explicitly (cryptify#165 follow-on, postguard-website#228, postguard-outlook-addon#96, postguard-tb-addon#121).
4. API surface list (line 111-115 bulleted list in this page) — add GET /metrics bullet for parity with architecture.md and postguard.md.

Style: PostGuard writing rules — no banned words, no em dashes, no bold emphasis beyond the existing pattern, source-link blocks pinned to the merge commits above.

Verification: npx vitepress build docs must pass and confirm docs/.vitepress/dist/repos/cryptify.html renders.

PR will be opened ready-for-review (postguard-docs has CI), reviewer @rubenhensen, Closes #103 in the body.