feat(monitoring): add nginx, postgres, valkey prometheus exporters

- nginx: nginx-prometheus-exporter gated by nginx_exporter_enabled,
  deploys loopback-only stub_status (8090), exporter on 9113
- postgres: postgres_exporter gated by postgres_exporter_enabled,
  creates postgres_exporter role with pg_monitor, exporter on 9187
- valkey: redis_exporter gated by valkey_exporter_enabled, adds
  read-only ACL user to users.acl, exporter on 9121

Each exporter follows the nut pattern (tasks/exporter.yml included from
main.yml, OS vars, 0600 secret env files, password asserts).

roles/valkey/tasks/exporter.yml

@@ -0,0 +1,36 @@
+---
+# Prometheus valkey exporter (optional, gated by valkey_exporter_enabled).
+# Authenticates as the read-only valkey_exporter ACL user created by the
+# users.acl template.
+
+- name: Validate exporter password is set
+  ansible.builtin.assert:
+    that:
+      - valkey_exporter_password is defined
+      - valkey_exporter_password | length >= 12
+    fail_msg: |
+      valkey_exporter_password is required (min 12 chars) when
+      valkey_exporter_enabled is true.
+      See roles/valkey/defaults/main.yml for configuration instructions.
+    success_msg: "Exporter password validation passed"
+
+- name: Install redis_exporter
+  ansible.builtin.package:
+    name: "{{ valkey_exporter_package }}"
+    state: present
+
+- name: Deploy exporter environment file
+  ansible.builtin.template:
+    src: exporter-env.conf.j2
+    dest: "{{ valkey_exporter_args_file }}"
+    owner: root
+    group: root
+    mode: "0600"
+  notify: Restart valkey exporter
+
+- name: Enable and start redis_exporter
+  ansible.builtin.systemd:
+    name: "{{ valkey_exporter_service }}"
+    enabled: true
+    state: started
+    daemon_reload: true