“A number that learned how not to scream”: the case for community-led metrics on protection