feat(homeassistant): its page offers the metrics scrape under the same sign-in, so one user covers everything (#6744)

A Prometheus target's token_from names the plugin that supplies its token at each
scrape. Read its metrics makes the target; Use this sign-in moves one at that address
across, keeping its name, filters and history. A refusal stops the connection, so one
Try again or sign-in starts everything, and the sign-in is only sent to its own address.
A 404 says how to turn on Home Assistant's Prometheus integration, as Steward doesn't
change Home Assistant. Refused also joins the volatile columns a backup check ignores.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/plugins/prometheus/test_service.py

@@ -141,6 +141,10 @@ def test_the_form_checks_what_it_stores_and_keeps_a_blank_token():
     assert again["token"] == "enc:v1:kept" and "enabled" not in again
     cleared = parse_form(_Form(name="Archives", url="http://a/metrics", clear_token="on"), existing)
     assert cleared["token"] == ""
+    lent = PrometheusTarget(name="Archives", url="http://a/metrics", token="", token_from="a_plugin")
+    assert parse_form(_Form(name="Archives", url="http://a/metrics"), lent)["token_from"] == "a_plugin"
+    typed = parse_form(_Form(name="Archives", url="http://a/metrics", token="s3cret"), lent)
+    assert typed["token_from"] is None and typed["token"]
     for bad in (dict(name="", url="http://a"), dict(name="a:b", url="http://a"),
                 dict(name="a", url="ftp://a"), dict(name="a", url="http://a", interval_seconds="5"),
                 dict(name="a", url="http://a", series_cap="0")):