feat(homeassistant): its page offers the metrics scrape under the same sign-in, so one user covers everything (#6744)

A Prometheus target's token_from names the plugin that supplies its token at each
scrape. Read its metrics makes the target; Use this sign-in moves one at that address
across, keeping its name, filters and history. A refusal stops the connection, so one
Try again or sign-in starts everything, and the sign-in is only sent to its own address.
A 404 says how to turn on Home Assistant's Prometheus integration, as Steward doesn't
change Home Assistant. Refused also joins the volatile columns a backup check ignores.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

plugins/prometheus/templates/prometheus/form.html

@@ -37,8 +37,12 @@
       <div class="field">
         <label class="field-label" for="prom-token">Bearer token</label>
         <input class="input" id="prom-token" name="token" type="password" autocomplete="new-password"
-               placeholder="{{ 'kept; type to change' if v.has_token else 'none' }}">
+               placeholder="{{ 'from a sign-in; type to change' if v.token_from else ('kept; type to change' if v.has_token else 'none') }}">
+        {% if v.token_from %}
+        <span class="field-hint">Comes from the sign-in on the {{ v.token_from }} plugin's page, so that one user covers this too. Typing a token here uses that instead.</span>
+        {% else %}
         <span class="field-hint">Sent as "Authorization: Bearer …". Blank {{ "keeps the saved one" if v.has_token else "sends none" }}.</span>
+        {% endif %}
         {% if v.has_token %}
         <label style="display:flex;gap:0.5rem;align-items:center;margin-top:0.3rem;cursor:pointer;">
           <input type="checkbox" name="clear_token" value="on"> <span class="field-hint">Remove the saved token</span>