feat(monitoring): standardize on Zabbix

[viasnake]

Summary

• standardize monitoring on Zabbix 7.0 LTS
• repurpose monitor01 as the Zabbix server/frontend host with local PostgreSQL and Caddy/PHP-FPM
• install Zabbix Agent 2 on every managed host and purge node exporter
• reconcile the Ansible inventory into Zabbix host groups, interfaces, templates, tags, and macros
• monitor svc_mysql with MySQL by Zabbix agent 2 using a local socket-authenticated monitoring user
• remove the Prometheus, Alertmanager, Grafana, blackbox exporter, and node exporter roles and purge their installed packages/configuration
• replace Prometheus monitoring documentation with the Zabbix operating model

Secrets

monitor01 requires these ignored local variables before apply:

services_monitoring_database_password: <16+ letters, digits, underscore, or hyphen>
services_monitoring_admin_password: <generated strong value>

Validation

• changed YAML parses successfully
• GitHub Actions CI passed
• yamllint passed
• ansible-lint passed
• syntax checks passed for site.yml, bootstrap.yml, and cloudflare.yml

Migration behavior

This intentionally provides no compatibility layer for the retired monitoring stack. Applying the new foundation/service state removes the previous Prometheus-family packages and configuration and converges the hosts on Zabbix.