fix: vpn-router-setup owns only the creation of the metrics service's account, which is marked internal, and administrators add service accounts with vpn-router-user add --service and /users.

ADR.md

@@ -558,7 +558,7 @@ purge. A view shows only what its level keeps, so a shorter retention empties th
 view. A month view needs the hourly rows and a year view the monthly rows. `/metrics` has only the
 last sample; history is not scraped.
 
-## ADR-23: /metrics takes HTTP Basic authentication of a service account that setup owns
+## ADR-23: /metrics takes HTTP Basic authentication of an internal service account that setup creates
 
 Status: Accepted
 
@@ -568,11 +568,14 @@ API or the Manager, and its password should be checked and locked out like any o
 belongs to the package's metrics, not to the people using the router.
 
 Decision: A service account is a Manager-only account (ADR-18) with `vpnRouterScope` `service`.
-`vpn-router-setup` owns it: while metrics are enabled it adds the account `metrics.service_account`
-names, `metrics` by default, with a random password it writes to `/etc/vpn-router/metrics.secret`
-(root only), and sets a new random password, ending a lockout, when the file is missing or no
-longer holds the password. `vpn-router-user` and `/users` cannot add one. `/auth` refuses it
-with the message of a wrong password. `/metrics` accepts HTTP Basic only for that account, and
+Administrators add service accounts with `vpn-router-user add --service` and `/users`, for
+services of their own that check passwords against the directory, and manage them like other
+accounts. The metrics service's is the internal one, created by `vpn-router-setup`: while metrics
+are enabled it adds the account `metrics.service_account` names, `metrics` by default, with a
+random password it writes to `/etc/vpn-router/metrics.secret` (root only), and sets a new random
+password, ending a lockout, when the file is missing or no longer holds the password. The answers
+of `/users` mark it as `internal`, and `/users` refuses to set its password, which setup would
+replace. `/auth` refuses every service account with the message of a wrong password. `/metrics` accepts HTTP Basic only for that account, and
 only when it is a service account; the password is checked with a bind as the account, so the
 password policy's lockout applies (ADR-14). TLS is Caddy's, on `metrics.https_port` (ADR-21);
 plain HTTP is served on the interfaces `metrics.listen` names, `internal` by default.