But will the app.MapPrometheusScrapingEndpoint(); not be available publicly?

Looks good. What is best practice regarding authentication of the metrics endpoint?

List patterns are my favorite:

if (items is [.. var front, 42])
{
Console.WriteLine(front.Length);
}