zot version

v2.1.5-9-g552242f5

Describe the bug

With user authentication (at least htpasswd) turned on in zot-minimal config zxp exports only some general metrics like go_*, process_*, but not the zot_*

And it doesn't matter, whether you specify user:password in request to zxp or not.

zot log:
{"level":"info","module":"http","component":"session","clientIP":"127.0.0.1:33456","method":"GET","path":"/metrics","statusCode":401,"latency":"0s","bodySize":266,"headers":{"Accept-Encoding":["gzip"],"User-Agent":["Go-http-client/1.1"]},"goroutine":129,"caller":"zotregistry.dev/zot/pkg/api/session.go:137","time":"2025-07-16T09:35:18.51698461Z","message":"HTTP API"}

It looks like zxp ignores the authorization header it gets from user and sends an unauthorized request to zot

To reproduce

zot-linux-amd64-minimal serve /tmp/zot_test/zot_config2.json &
zxp-linux-amd64 config /tmp/zot_test/zxp_config2.json &
curl -u observability:password http://127.0.0.1:5001/metrics

zxp_config2.json
zot_config2.json

Expected behavior

I expect to receive the full set of metrics, as would happen if the accessControl and auth sections of the config were removed

Screenshots

No response

Additional context

No response