Add a scoped, read-only metrics / monitoring API key (alternative to service_role)

Problem Supabase exposes project metrics via the privileged endpoint: Access to this endpoint currently requires the service_role key. While this works functionally, it creates a security and operational concern: service_role bypasses RLS and provides full admin access (DB, auth, storage, RPC). For monitoring use cases, this level of privilege is significantly broader than required. This becomes especially problematic when integrating with: * SaaS monitoring platforms (Datadog, Grafana Cloud, pgpulse, etc.) * Hosted metrics backends * Third-party observability tools Many security teams will not approve sharing a full admin key with external services, which effectively blocks adoption of Supabase metrics without running a custom proxy. --- Proposed solution Introduce a scoped, read-only monitoring token, for example: * metrics_role / monitoring_role * Read-only access * Valid only for metrics endpoints (e.g. /metrics) * Does no…