fix: record AUTH attempt metrics in WebSocket handler

Add RecordAuthAttempt calls to handleAuth so successful and failed
AUTH attempts are tracked in metrics. This fixes the dashboard
'Challenges' counter which was always showing 0.

The deferred call ensures both success and failure cases are recorded:
- success=true when AUTH completes successfully
- success=false when AUTH fails (invalid signature, wrong challenge, etc.)

Updated MetricsRecorder interface and mock to include RecordAuthAttempt.

2 files changed, 10 insertions, 0 deletions

diff --git a/internal/handler/websocket/handler.go b/internal/handler/websocket/handler.go
index de71926..dfe7b9e 100644
--- a/internal/handler/websocket/handler.go
+++ b/internal/handler/websocket/handler.go
@@ -33,6 +33,7 @@ type MetricsRecorder interface {
         DecrementSubscriptions()
         SetActiveSubscriptions(count int)
         RecordRequest(method, status string, duration float64)
+        RecordAuthAttempt(success bool)
         RecordBlockedEvent(kind int32)
 }
 
@@ -522,6 +523,13 @@ func (h *Handler) sendAuthChallenge(ctx context.Context, conn *websocket.Conn, c
 }
 
 func (h *Handler) handleAuth(ctx context.Context, conn *websocket.Conn, raw []json.RawMessage, state *connState) error {
+        success := false
+        defer func() {
+                if h.metrics != nil {
+                        h.metrics.RecordAuthAttempt(success)
+                }
+        }()
+
         if len(raw) != 2 {
                 return fmt.Errorf("AUTH expects 2 elements")
         }
@@ -560,6 +568,7 @@ func (h *Handler) handleAuth(ctx context.Context, conn *websocket.Conn, raw []js
         state.authenticatedPubkey = authEvent.PubKey
         log.Printf("WebSocket client authenticated: %s", authEvent.PubKey[:16])
 
+        success = true
         // Don't send OK for AUTH - it's not an EVENT
         return nil
 }
diff --git a/internal/handler/websocket/handler_test.go b/internal/handler/websocket/handler_test.go
index 9982aea..10405b2 100644
--- a/internal/handler/websocket/handler_test.go
+++ b/internal/handler/websocket/handler_test.go
@@ -97,6 +97,7 @@ func (m *mockMetrics) RecordRequest(method, status string, duration float64) {
         key := fmt.Sprintf("%s:%s", method, status)
         m.requests[key]++
 }
+func (m *mockMetrics) RecordAuthAttempt(success bool) {}
 func (m *mockMetrics) RecordBlockedEvent(kind int32) {
         m.mu.Lock()
         defer m.mu.Unlock()