feat(monitoring): add nginx, postgres, valkey prometheus exporters

- nginx: nginx-prometheus-exporter gated by nginx_exporter_enabled,
  deploys loopback-only stub_status (8090), exporter on 9113
- postgres: postgres_exporter gated by postgres_exporter_enabled,
  creates postgres_exporter role with pg_monitor, exporter on 9187
- valkey: redis_exporter gated by valkey_exporter_enabled, adds
  read-only ACL user to users.acl, exporter on 9121

Each exporter follows the nut pattern (tasks/exporter.yml included from
main.yml, OS vars, 0600 secret env files, password asserts).

roles/nginx/README.md

@@ -28,6 +28,26 @@ hostname and breaking TLS verification on other vhosts.
 
 Disable with `nginx_default_server_enabled: false`.
 
+## Prometheus exporter
+
+Optionally exposes nginx metrics (active connections, requests/sec) for
+Prometheus via `nginx-prometheus-exporter`, which scrapes a loopback-only
+`stub_status` endpoint this role deploys. Enable it:
+
+```yaml
+nginx_exporter_enabled: true
+```
+
+The exporter binds to `127.0.0.1:9113`; the `stub_status` block listens on
+`127.0.0.1:8090` and denies non-localhost clients. Pair it with a scrape job:
+
+```yaml
+prometheus_scrape_configs:
+  - job_name: 'nginx'
+    static_configs:
+      - targets: ['127.0.0.1:9113']
+```
+
 ## Service Integration Pattern
 
 Each service role should deploy its own vhost config: