feat(monitoring): add nginx, postgres, valkey prometheus exporters

- nginx: nginx-prometheus-exporter gated by nginx_exporter_enabled,
  deploys loopback-only stub_status (8090), exporter on 9113
- postgres: postgres_exporter gated by postgres_exporter_enabled,
  creates postgres_exporter role with pg_monitor, exporter on 9187
- valkey: redis_exporter gated by valkey_exporter_enabled, adds
  read-only ACL user to users.acl, exporter on 9121

Each exporter follows the nut pattern (tasks/exporter.yml included from
main.yml, OS vars, 0600 secret env files, password asserts).

roles/valkey/defaults/main.yml

@@ -35,6 +35,20 @@ valkey_acl_users: []
 #     keypattern: "*"      # Keys this user can access
 #     commands: "+@all -@dangerous"  # Allowed commands
 
+# Prometheus exporter (optional, via redis_exporter). Creates a dedicated
+# read-only ACL user for monitoring.
+valkey_exporter_enabled: false
+valkey_exporter_listen_address: "127.0.0.1:9121"
+valkey_exporter_redis_addr: "redis://127.0.0.1:6379"
+valkey_exporter_user: valkey_exporter
+# valkey_exporter_password: ""  # Intentionally undefined - required when enabled
+# Read-only command set recommended by redis_exporter for monitoring.
+valkey_exporter_commands: >-
+  -@all +@connection +memory -readonly +strlen +config|get +xinfo +pfcount
+  -quit +zcard +type +xlen -readwrite -command +client -wait +scard +llen
+  +hlen +arcount +get +eval +slowlog +cluster|info +cluster|slots +cluster|nodes
+  -hello -echo +info +latency +scan -reset -auth -asking
+
 # Valkey log level (debug, verbose, notice, warning)
 valkey_loglevel: notice