feat: Mint metrics tokens for Datum

[Aradhya-Tripathi]

Datum stores metrics behind vmauth, which checks a Central-signed JWT before
anything reaches the store. It reads vm_access.metrics_extra_labels off the
token and hands them to VictoriaMetrics, which stamps them over whatever the
producer sent — so a pilot can't write as another resource even if it claims
one in the request body.

Central had no token for that. The existing mints are bench logins, site logins
and enrolment: all short-lived, none carrying a resource id.

This adds mint_metrics_token, and a metrics_token endpoint the pilot calls
with its usual X-Pilot-Token:

{
  "aud": "<pilot_credential_id>",
  "scope": "datum",
  "vm_access": {"metrics_extra_labels": ["resource_id=vm-abc123"]}
}

scope is the part that matters. Every downward token is signed with the same
key, so without it the gateway would treat a bench SID as permission to write
metrics. vmauth matches on scope: datum and rejects everything else.

The resource id comes from the credential's linked Asset. That's only bound
after Atlas provisions, so a pilot asking too early is told to wait rather than
handed a token whose samples couldn't be attributed to anything.

It's a separate endpoint rather than part of config because it expires — the
pilot re-fetches on a TTL, or when the gateway answers 401.

Verified the claim shape against a real vmauth: the token is accepted, and a
body claiming a different resource_id is overwritten with the one from the
token.