monitoring: implement monitoring gaps coverage

Add exporters and scrape targets for services lacking monitoring:
- PostgreSQL: postgres-exporter on pgdb1
- Authelia: native telemetry metrics on auth01
- Unbound: unbound-exporter with remote-control on ns1/ns2
- NATS: HTTP monitoring endpoint on nats1
- OpenBao: telemetry config and Prometheus scrape with token auth
- Systemd: systemd-exporter on all hosts for per-service metrics

Add alert rules for postgres, auth (authelia + lldap), jellyfin,
vault (openbao), plus extend existing nats and unbound rules.

Add Terraform config for Prometheus metrics policy and token. The
token is created via vault_token resource and stored in KV, so no
manual token creation is needed.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

services/monitoring/prometheus.nix

@@ -7,8 +7,19 @@ let
   autoScrapeConfigs = monLib.generateScrapeConfigs self externalTargets;
 in
 {
+  # OpenBao token for scraping metrics
+  vault.secrets.openbao-token = {
+    secretPath = "hosts/monitoring01/openbao-token";
+    extractKey = "token";
+    outputDir = "/run/secrets/prometheus";
+    mode = "0400";
+    owner = "prometheus";
+    services = [ "prometheus" ];
+  };
   services.prometheus = {
     enable = true;
+    # syntax-only check because we use external credential files (e.g., openbao-token)
+    checkConfig = "syntax-only";
     alertmanager = {
       enable = true;
       configuration = {
@@ -61,6 +72,15 @@ in
           }
         ];
       }
+      # Systemd exporter on all hosts (same targets, different port)
+      {
+        job_name = "systemd-exporter";
+        static_configs = [
+          {
+            targets = map (t: builtins.replaceStrings [":9100"] [":9558"] t) nodeExporterTargets;
+          }
+        ];
+      }
       # Local monitoring services (not auto-generated)
       {
         job_name = "prometheus";
@@ -152,6 +172,22 @@ in
           }
         ];
       }
+      # OpenBao metrics with bearer token auth
+      {
+        job_name = "openbao";
+        scheme = "https";
+        metrics_path = "/v1/sys/metrics";
+        params = {
+          format = [ "prometheus" ];
+        };
+        static_configs = [{
+          targets = [ "vault01.home.2rjus.net:8200" ];
+        }];
+        authorization = {
+          type = "Bearer";
+          credentials_file = "/run/secrets/prometheus/openbao-token";
+        };
+      }
     ] ++ autoScrapeConfigs;
 
     pushgateway = {