feat(homeassistant): its page offers the metrics scrape under the same sign-in, so one user covers everything (#6744)

A Prometheus target's token_from names the plugin that supplies its token at each
scrape. Read its metrics makes the target; Use this sign-in moves one at that address
across, keeping its name, filters and history. A refusal stops the connection, so one
Try again or sign-in starts everything, and the sign-in is only sent to its own address.
A 404 says how to turn on Home Assistant's Prometheus integration, as Steward doesn't
change Home Assistant. Refused also joins the volatile columns a backup check ignores.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

plugins/prometheus/routes.py

@@ -12,13 +12,14 @@ from sqlalchemy import delete, func, select, update
 
 from steward.auth.middleware import require_role
 from steward.core.audit import log_audit
-from steward.core.crypto import decrypt_secret
 from steward.core.metric_series import latest_values, points
+from steward.core.prometheus import TokenUnavailable
 from steward.models.metrics import PluginMetric, PluginMetricLatest
 from steward.models.users import UserRole
 
 from . import library
 from .models import PrometheusTarget, PrometheusWidgetTemplate
+from .scheduler import target_token
 from .scraper import ScrapeError, scrape
 from .service import (OWN_METRICS, SOURCE, FormError, fold_states, form_values, is_moment, map_families,
                       parse_form, patterns, shown_value, target_state)
@@ -80,7 +81,8 @@ def _typed(form, target: PrometheusTarget | None = None) -> dict:
     return {"name": form.get("name", ""), "url": form.get("url", ""),
             "interval_seconds": form.get("interval_seconds", ""), "series_cap": form.get("series_cap", ""),
             "keep": form.get("keep", ""), "drop": form.get("drop", ""),
-            "verify_tls": bool(form.get("verify_tls")), "has_token": bool(target and target.token)}
+            "verify_tls": bool(form.get("verify_tls")), "has_token": bool(target and target.token),
+            "token_from": target.token_from if target else None}
 
 
 async def _name_taken(db, name: str, other_than: str | None = None) -> bool:
@@ -235,10 +237,15 @@ async def test_target():
             existing = await db.get(PrometheusTarget, form["target_id"])
     url = (form.get("url") or "").strip()
     token = (form.get("token") or "").strip()
-    if not token and existing is not None and existing.token and not form.get("clear_token"):
-        token = decrypt_secret(existing.token, context=f"prometheus target {existing.name} token")
     found: dict = {}
-    if not url.startswith(("http://", "https://")):
+    if not token and existing is not None and not form.get("clear_token"):
+        try:
+            token = await target_token(current_app, existing, url)
+        except TokenUnavailable as exc:
+            found["error"] = str(exc)
+    if found:
+        pass
+    elif not url.startswith(("http://", "https://")):
         found["error"] = "Enter the address first: http://… or https://…"
     else:
         try: