fix: harden typed metrics review findings

crates/crank-observability/tests/prometheus.rs

@@ -28,6 +28,35 @@ fn loopback_is_allowed_without_a_token() {
     assert!(!config.requires_authentication());
 }
 
+#[test]
+fn disabled_config_remains_disabled_without_auth_side_effects() {
+    let config = MetricsConfig::new(
+        false,
+        SocketAddr::new(IpAddr::V4(Ipv4Addr::UNSPECIFIED), 9464),
+        None,
+    )
+    .expect("disabled listener does not require a token");
+    assert!(!config.enabled());
+}
+
+#[tokio::test]
+async fn bind_collision_returns_a_typed_safe_error() {
+    let listener = tokio::net::TcpListener::bind((Ipv4Addr::LOCALHOST, 0))
+        .await
+        .unwrap();
+    let address = listener.local_addr().unwrap();
+    let config = MetricsConfig::new(true, address, None).unwrap();
+    let error = match MetricsSurface::for_test(config, identity())
+        .unwrap()
+        .bind()
+        .await
+    {
+        Ok(_) => panic!("occupied port must fail closed"),
+        Err(error) => error,
+    };
+    assert_eq!(error.to_string(), "failed to bind metrics listener");
+}
+
 #[tokio::test]
 async fn default_service_ports_bind_and_serve_real_metrics_listeners() {
     for (service, port) in [("admin-api", 9464), ("mcp-server", 9465)] {