Stealth sen:// port, random cert names, external Prometheus card

The subscription port answered every request with signed JSON: one probe
told a scanner what it had found, and the public key from any sen:// link
pinned the exact server. It now speaks the protocol only to those who prove
a secret — peek and register with the link's master secret, everything else
with a valid device signature — and gives Go's plain "404 page not found"
to the rest. A deleted device still gets its 410, but only when the request
is signed with its key, kept in the new revoked_devices table. The migration
freeze answers only proven clients too.

Self-signed certs for the subscription (SUB_TLS=on) and the node hub got
fixed names (sen, awg-node); new ones get a random host-like name. Clients
and nodes pin the key, so existing certs keep working.

The panel could already issue a metrics-only token, but nothing in the UI
used it. The Monitor tab gets an "External Prometheus" card: issue, reissue
and revoke the token, with a ready prometheus.yml fragment whose address is
taken from the page, so it carries the secret path or the nginx subfolder.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013bNGYiDst62wH3ZGTRPFLJ

awg-ui/src/tabs/monitor/index.tsx

@@ -5,6 +5,7 @@ import { useState, useEffect, useCallback, useRef } from 'react';
 import { apiFetch, copyText, getServerId, type NodeInfo, type PageProps } from '../../lib/shared';
 import { IcoCopy, IcoTrash } from '../../components/icons';
 import LineChart from '../../components/LineChart';
+import ExternalPrometheus from './ExternalPrometheus';
 import './monitor.css';
 
 // Вкладка «Монитор»: встроенный Prometheus и основные графики.
@@ -360,6 +361,7 @@ export default function MonitorPage({ token, showMsg }: PageProps) {
             {setup}
             {dashboard}
             {manage}
+            <ExternalPrometheus token={token} showMsg={showMsg} />
         </>
     );
 }