Scrape Ledgerline's metrics from falken through czy's Traefik

czy publishes no service ports, so Traefik exposes each service's :9464
as https://ledgerline.vione.cloud/metrics/<service> behind basic auth,
and the platform's Prometheus gets a `ledgerline` job with one target
per service. The targets share an address; a `service` label tells them
apart, and relabels derive __metrics_path__ and instance from it.

create-secrets.sh now also creates the prometheus-scrape-auth secret
(mounted optional, so a missing secret fails only this job) and writes
the gitignored htpasswd file Traefik reads, which is copied to czy like
.env.observability.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

k8s/prometheus/deployment.yaml

@@ -48,6 +48,9 @@ spec:
               mountPath: /etc/prometheus/rules
             - name: data
               mountPath: /prometheus
+            - name: scrape-auth
+              mountPath: /etc/prometheus/secrets
+              readOnly: true
       volumes:
         - name: config
           configMap:
@@ -58,3 +61,10 @@ spec:
         - name: data
           persistentVolumeClaim:
             claimName: prometheus-data
+        # Basic-auth credentials for the `ledgerline` scrape job, created by
+        # create-secrets.sh. Optional so a missing secret costs that job's
+        # scrapes (up == 0) rather than the whole Prometheus pod.
+        - name: scrape-auth
+          secret:
+            secretName: prometheus-scrape-auth
+            optional: true