fix: service accounts are managed at /service-accounts, not /users, and the internal one of the metrics service is only listed.

ADR.md

@@ -568,22 +568,27 @@ API or the Manager, and its password should be checked and locked out like any o
 belongs to the package's metrics, not to the people using the router.
 
 Decision: A service account is a Manager-only account (ADR-18) with `vpnRouterScope` `service`.
-Administrators add service accounts with `vpn-router-user add --service` and `/users`, for
-services of their own that check passwords against the directory, and manage them like other
-accounts. The metrics service's is the internal one, created by `vpn-router-setup`: while metrics
-are enabled it adds the account `metrics.service_account` names, `metrics` by default, with a
-random password it writes to `/etc/vpn-router/metrics.secret` (root only), and sets a new random
-password, ending a lockout, when the file is missing or no longer holds the password. The answers
-of `/users` mark it as `internal`, and `/users` refuses to set its password, which setup would
-replace. `/auth` refuses every service account with the message of a wrong password. `/metrics` accepts HTTP Basic only for that account, and
+Administrators add service accounts with `vpn-router-user add --service` and the web service's
+`/service-accounts`, for services of their own that check passwords against the directory.
+`/service-accounts` is a path of its own, apart from `/users`, which does not list or serve them:
+a service account has no names, certificate, profile or TOTP, and is not a person an
+administrator manages with the users. The metrics service's is the internal one, created by
+`vpn-router-setup`: while metrics are enabled it adds the account `metrics.service_account` names,
+`metrics` by default, with a random password it writes to `/etc/vpn-router/metrics.secret` (root
+only), and sets a new random password, ending a lockout, when the file is missing or no longer
+holds the password. `/service-accounts` marks it as `internal` and only lists it: every other
+request on it, and putting it in or taking it out of a group at `/groups`, gets 403, whatever the
+token. Setup
+changes it through the directory's user-manager account, not the API, and root may still with
+`vpn-router-user`. `/auth` refuses every service account with the message of a wrong password. `/metrics` accepts HTTP Basic only for that account, and
 only when it is a service account; the password is checked with a bind as the account, so the
 password policy's lockout applies (ADR-14). TLS is Caddy's, on `metrics.https_port` (ADR-21);
 plain HTTP is served on the interfaces `metrics.listen` names, `internal` by default.
 
 Consequences: Every scrape binds to slapd once. The collector's operator copies the password from
 the router; deleting the file and running setup changes it. A user who already has the name is not
-taken over; setup fails until `metrics.service_account` names another. A disabled account stays
-disabled. A scraper on the external interface over plain HTTP sends the password in the clear, so
+taken over; setup fails until `metrics.service_account` names another. An account root disabled
+stays disabled. A scraper on the external interface over plain HTTP sends the password in the clear, so
 `metrics.listen` stays `internal` unless HTTPS is used.
 
 ## ADR-24: The Router Manager upgrades the router's packages in a transient unit outside its own