fix: address PR feedback + expand infrastructure coverage

- Replace unpoller-credentials plain Secret with ExternalSecret
  pulling from Bitwarden item 15bfc957-5de5-49b2-ab6c-b41800e71564
  via bitwarden-login ClusterSecretStore (username + password)
- Pull UP_UNIFI_DEFAULT_USER from secret as well (was hardcoded)

- Add OpenWRT access point (10.42.0.3) to genesis DNS hosts file
  as ap.thehellings.lan (discovered during network scan)

- Add blackbox exporter to genesis (port 9115, ICMP module)
  for probing non-NixOS infrastructure that has no node_exporter:
  OpenWRT AP, Joel, pve1, chronicles, nas1, odoo, mattermost,
  homeassistant, USW-Pro-HD-24 UniFi switch

- Add infra_ping scrape job to Prometheus using blackbox prober
  targeting all non-NixOS LAN hosts via genesis blackbox exporter

hosts/unstable/genesis/net/hosts

@@ -1,5 +1,6 @@
 # Local hosts
 10.42.0.1 switch switch.thehellings.lan  # Core switch for the network
+10.42.0.3 ap ap.thehellings.lan  # OpenWRT access point (static IP)
 10.42.0.4 joel.thehellings.lan  # Proxmox
 10.42.0.5 sanswitch.thehellings.lan  # Core switch for the SAN
 

hosts/unstable/genesis/networking.nix

@@ -112,6 +112,18 @@ in
 
     prometheus.exporters = {
       dnsmasq.enable = true;
+      blackbox = {
+        enable = true;
+        openFirewall = true;
+        configFile = pkgs.writeText "blackbox.yml" ''
+          modules:
+            icmp:
+              prober: icmp
+              timeout: 5s
+              icmp:
+                preferred_ip_protocol: ip4
+        '';
+      };
     };
   }; # End of services configuration