fix: address PR feedback + expand infrastructure coverage

- Replace unpoller-credentials plain Secret with ExternalSecret
  pulling from Bitwarden item 15bfc957-5de5-49b2-ab6c-b41800e71564
  via bitwarden-login ClusterSecretStore (username + password)
- Pull UP_UNIFI_DEFAULT_USER from secret as well (was hardcoded)

- Add OpenWRT access point (10.42.0.3) to genesis DNS hosts file
  as ap.thehellings.lan (discovered during network scan)

- Add blackbox exporter to genesis (port 9115, ICMP module)
  for probing non-NixOS infrastructure that has no node_exporter:
  OpenWRT AP, Joel, pve1, chronicles, nas1, odoo, mattermost,
  homeassistant, USW-Pro-HD-24 UniFi switch

- Add infra_ping scrape job to Prometheus using blackbox prober
  targeting all non-NixOS LAN hosts via genesis blackbox exporter

manifests/monitoring/config.yaml

@@ -43,6 +43,29 @@ data:
               - "hosea.shire-zebra.ts.net:9427"
               - "exodus.shire-zebra.ts.net:9427"
               - "linode.shire-zebra.ts.net:9427"
+      # ICMP ping reachability for non-NixOS infrastructure
+      - job_name: infra_ping
+        metrics_path: /probe
+        params:
+          module: [icmp]
+        static_configs:
+          - targets:
+              - "10.42.0.3"    # OpenWRT access point
+              - "10.42.0.4"    # Joel (Proxmox)
+              - "10.42.1.1"    # pve1 (Proxmox)
+              - "10.42.1.4"    # chronicles (Synology NAS)
+              - "10.42.1.14"   # nas1 (TrueNAS)
+              - "10.42.2.57"   # odoo
+              - "10.42.2.89"   # mattermost
+              - "10.42.2.155"  # homeassistant
+              - "10.42.3.58"   # USW-Pro-HD-24 (UniFi switch)
+        relabel_configs:
+          - source_labels: [__address__]
+            target_label: __param_target
+          - source_labels: [__param_target]
+            target_label: instance
+          - target_label: __address__
+            replacement: "genesis.shire-zebra.ts.net:9115"
       - job_name: kea
         static_configs:
           - targets: