feat(monitoring): add nginx, postgres, valkey prometheus exporters

- nginx: nginx-prometheus-exporter gated by nginx_exporter_enabled,
  deploys loopback-only stub_status (8090), exporter on 9113
- postgres: postgres_exporter gated by postgres_exporter_enabled,
  creates postgres_exporter role with pg_monitor, exporter on 9187
- valkey: redis_exporter gated by valkey_exporter_enabled, adds
  read-only ACL user to users.acl, exporter on 9121

Each exporter follows the nut pattern (tasks/exporter.yml included from
main.yml, OS vars, 0600 secret env files, password asserts).

roles/postgres/README.md

@@ -85,6 +85,27 @@ sudo -u postgres psql -c "SHOW shared_buffers;"
 sudo -u postgres psql -c "SHOW effective_cache_size;"
 ```
 
+## Prometheus exporter
+
+Optionally exposes PostgreSQL metrics (connections, cache hit ratio, deadlocks)
+via `postgres_exporter`. Enable it:
+
+```yaml
+postgres_exporter_enabled: true
+postgres_exporter_password: "<min 12 chars>"  # keep URL-safe
+```
+
+The role creates a `postgres_exporter` monitoring role with the built-in
+`pg_monitor` role (no superuser). The exporter binds to `127.0.0.1:9187`;
+pair it with a scrape job:
+
+```yaml
+prometheus_scrape_configs:
+  - job_name: 'postgres'
+    static_configs:
+      - targets: ['127.0.0.1:9187']
+```
+
 ## References
 
 - [PostgreSQL Documentation](https://www.postgresql.org/docs/current/)