fix: address PR feedback + expand infrastructure coverage

- Replace unpoller-credentials plain Secret with ExternalSecret
  pulling from Bitwarden item 15bfc957-5de5-49b2-ab6c-b41800e71564
  via bitwarden-login ClusterSecretStore (username + password)
- Pull UP_UNIFI_DEFAULT_USER from secret as well (was hardcoded)

- Add OpenWRT access point (10.42.0.3) to genesis DNS hosts file
  as ap.thehellings.lan (discovered during network scan)

- Add blackbox exporter to genesis (port 9115, ICMP module)
  for probing non-NixOS infrastructure that has no node_exporter:
  OpenWRT AP, Joel, pve1, chronicles, nas1, odoo, mattermost,
  homeassistant, USW-Pro-HD-24 UniFi switch

- Add infra_ping scrape job to Prometheus using blackbox prober
  targeting all non-NixOS LAN hosts via genesis blackbox exporter

manifests/monitoring/unpoller.yaml

@@ -1,13 +1,29 @@
 ---
-apiVersion: v1
-kind: Secret
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
 metadata:
   name: unpoller-credentials
-  namespace: monitoring
-type: Opaque
-stringData:
-  # Replace with actual UniFi controller password for the 'unpoller' read-only user
-  password: "CHANGEME"
+spec:
+  target:
+    name: unpoller-credentials
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        username: "{{ .username }}"
+        password: "{{ .password }}"
+  secretStoreRef:
+    name: bitwarden-login
+    kind: ClusterSecretStore
+  data:
+    - secretKey: username
+      remoteRef:
+        key: "15bfc957-5de5-49b2-ab6c-b41800e71564"
+        property: username
+    - secretKey: password
+      remoteRef:
+        key: "15bfc957-5de5-49b2-ab6c-b41800e71564"
+        property: password
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -38,7 +54,10 @@ spec:
             - name: UP_UNIFI_DEFAULT_VERIFY_SSL
               value: "false"
             - name: UP_UNIFI_DEFAULT_USER
-              value: "unpoller"
+              valueFrom:
+                secretKeyRef:
+                  name: unpoller-credentials
+                  key: username
             - name: UP_UNIFI_DEFAULT_PASS
               valueFrom:
                 secretKeyRef: