fix: internal service accounts are the router's own, of which the metrics service's is the one at present, and the documentation says what a service account is.

README.md

@@ -427,12 +427,14 @@ it is added:
   name, the password and an optional e-mail address, for notifications: no names and no
   certificate, so no VPN access. It can sign in to `/auth` and, as a member of `admins`, manage
   the router. `add` without the first and the last name adds one; its names cannot be set later;
-- a service account, a Manager-only account whose `vpnRouterScope` is `service`, for a service
-  that checks passwords against the directory; it cannot sign in to `/auth`. `add --service` adds
-  one, and the web service manages them at `/service-accounts`, not at `/users`. The internal one
-  is the account `metrics.service_account` names while metrics are enabled: `vpn-router-setup` adds
-  it and keeps its password (see Metrics). The API only lists it: `/service-accounts` refuses every
-  other request on it, and `/groups` refuses to put it in or take it out of a group, with 403.
+- a service account, a Manager-only account whose `vpnRouterScope` is `service`, which another
+  system signs in with to use a router service, such as an OpenTelemetry Collector reading
+  `/metrics`; it cannot sign in to `/auth`. `add --service` adds one, and the web service manages
+  them at `/service-accounts`, not at `/users`. Internal service accounts are those the router
+  creates and manages for its own services; at present that is the metrics service's, the account
+  `metrics.service_account` names while metrics are enabled (see Metrics). The API only lists
+  them: `/service-accounts` refuses every other request on one, and `/groups` refuses to put one
+  in or take one out of a group, with 403.
 
 Passwords and TOTP secrets are read from the first line of standard input. The answer is text: a
 table of the users, the client profile, a TOTP secret or a short message, and a failure is a
@@ -759,8 +761,8 @@ curl -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
 | `POST /service-accounts/<name>/unlock` | | the account |
 | `DELETE /service-accounts/<name>` | | `{"name", "removed": true}` |
 
-The internal account, `internal` true, is only listed: every other request on it gets 403, as
-`vpn-router-setup` adds and keeps it. A failure is otherwise as for `/users`, with 404 also for a
+The internal service accounts, `internal` true, are only listed: every other request on one gets
+403, as the router manages them. A failure is otherwise as for `/users`, with 404 also for a
 name that is not a service account.
 
 ### The /account API