Scrape Ledgerline's metrics from falken through czy's Traefik

czy publishes no service ports, so Traefik exposes each service's :9464
as https://ledgerline.vione.cloud/metrics/<service> behind basic auth,
and the platform's Prometheus gets a `ledgerline` job with one target
per service. The targets share an address; a `service` label tells them
apart, and relabels derive __metrics_path__ and instance from it.

create-secrets.sh now also creates the prometheus-scrape-auth secret
(mounted optional, so a missing secret fails only this job) and writes
the gitignored htpasswd file Traefik reads, which is copied to czy like
.env.observability.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CLAUDE.md

@@ -67,8 +67,9 @@ at one point in time and the user may have since extended them.
 2. **App metrics reach Prometheus by direct scrape, not through Alloy.** Alloy has
    no `prometheus.scrape` component; `k8s/prometheus/prometheus.yml` scrapes the
    stack's own components, and app jobs get added there (the role's
-   `prometheus_extra_scrape_jobs`). czy's service ports are unpublished, so no app
-   scrape path exists yet — a Phase 5 decision. Note that
+   `prometheus_extra_scrape_jobs`). czy's service ports are unpublished, so the
+   `ledgerline` job scrapes each service's `:9464` through czy's Traefik at
+   `https://ledgerline.vione.cloud/metrics/<service>` (basic auth). Note that
    the diagram draws this differently (app metrics routed via Alloy) — the diagram
    and the code have drifted, and the user knows. Don't "correct" one to the other
    unasked.