feat: comprehensive observability stack

- Add restic_backups and mattermost scrape jobs to Prometheus config
- Add UnPoller deployment+service+secret for UniFi metrics (unpoller.yaml)
- Add unifi scrape job targeting unpoller in-cluster
- Add 4 Grafana dashboards as NixOS-managed etc files on hosea:
  - system-health: CPU, memory, disk, network per host
  - backup-health: restic backup freshness and duration
  - kubernetes: pod counts, restart rates, node resources
  - network: DNS queries, DHCP leases, UniFi ports, ping latency
- Add grafana-api-token agenix secret placeholder on hosea
- Open firewall ports 9100/9427/9558 for prometheus exporters in baseline.nix

hosts/baseline.nix

@@ -114,6 +114,12 @@
     };
   };
 
+  networking.firewall.allowedTCPPorts = [
+    9100 # prometheus node exporter
+    9427 # prometheus ping exporter
+    9558 # prometheus systemd exporter
+  ];
+
   security.sudo.extraRules = [
     {
       users = [ "greg" ];