fix(ops): align smoke test with csrf and metrics access

scripts/smoke-test.sh

@@ -4,6 +4,13 @@ set -euo pipefail
 BASE_URL="${1:-http://localhost:8080}"
 PASS=0
 FAIL=0
+COOKIE_JAR="$(mktemp)"
+
+cleanup() {
+  rm -f "$COOKIE_JAR"
+}
+
+trap cleanup EXIT
 
 check() {
   local desc="$1"
@@ -29,8 +36,13 @@ check "Prometheus metrics" "$BASE_URL/actuator/prometheus" "200"
 check "Namespaces API" "$BASE_URL/api/v1/namespaces" "200"
 check "Auth required" "$BASE_URL/api/v1/auth/me" "401"
 
+curl -s -c "$COOKIE_JAR" "$BASE_URL/api/v1/auth/me" >/dev/null
+CSRF_TOKEN="$(awk '$6 == "XSRF-TOKEN" { print $7 }' "$COOKIE_JAR" | tail -n 1)"
+
 REGISTER_STATUS="$(curl -s -o /dev/null -w "%{http_code}" \
   -X POST "$BASE_URL/api/v1/auth/local/register" \
+  -b "$COOKIE_JAR" \
+  -H "X-XSRF-TOKEN: $CSRF_TOKEN" \
   -H "Content-Type: application/json" \
   -d '{"username":"smoketest","password":"Smoke@2026","email":"smoketest@example.com"}')"
 if [[ "$REGISTER_STATUS" == "200" || "$REGISTER_STATUS" == "409" ]]; then

server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/config/SecurityConfig.java

@@ -73,6 +73,7 @@ public class SecurityConfig {
                     "/api/v1/cli/auth/device/**",
                     "/api/v1/cli/check",
                     "/actuator/health",
+                    "/actuator/prometheus",
                     "/v3/api-docs/**",
                     "/swagger-ui/**",
                     "/.well-known/**",