feat(monitoring): add backup and systemd metrics, alerts, and dashboards

- backup role emits last-success/run metrics into node_exporter's textfile collector
- node_exporter enables systemd and textfile collectors
- prometheus deploys BackupStale/BackupTimerSilent/SystemdUnitFailed alert rules
- grafana gains Backups - Restic and Systemd dashboards
- fix prometheus.yml params rendering (quote values so {job=...} stays a string)

roles/prometheus/defaults/main.yml

@@ -43,10 +43,11 @@ prometheus_scrape_configs:
 #       - targets: ['localhost:9093']
 prometheus_alertmanager_configs: []
 
-# Rule files (optional)
-# prometheus_rule_files:
-#   - '/etc/prometheus/rules/*.yml'
-prometheus_rule_files: []
+# Rule files (optional). The rules directory is always created; drop .yml rule
+# files into /etc/prometheus/rules/ and they are picked up by this glob. The
+# role deploys backup-alerts.yml and systemd-alerts.yml there by default.
+prometheus_rule_files:
+  - '/etc/prometheus/rules/*.yml'
 
 # Nginx reverse proxy (optional)
 prometheus_nginx_enabled: false