feat(mon/alerting): route alerts to Telegram, add gateway and syslog rules

kubernetes-monitoring/apps/monitoring/release.yaml

@@ -59,10 +59,49 @@ spec:
     vmalert:
       enabled: true
 
-    # Telegram + email wired later (see monitoring-rpi5-setup.md step 11).
-    # Default config uses a blackhole receiver until then.
+    # k3s runs scheduler/controller-manager in one binary with no separate
+    # scrape endpoints, and uses kine instead of etcd — disabling these drops
+    # the empty scrape pools and their always-firing rules.
+    kubeScheduler:
+      enabled: false
+    kubeControllerManager:
+      enabled: false
+    kubeEtcd:
+      enabled: false
+
     alertmanager:
       enabled: true
+      spec:
+        # Mounted at /etc/vm/secrets/alertmanager-telegram/ (bot_token, chat_id).
+        secrets:
+          - alertmanager-telegram
+      config:
+        route:
+          receiver: telegram
+          group_by: ["alertname", "job"]
+          group_wait: 30s
+          group_interval: 5m
+          repeat_interval: 12h
+          routes:
+            - receiver: blackhole
+              matchers:
+                - alertname=~"Watchdog|InfoInhibitor"
+            - receiver: blackhole
+              matchers:
+                - severity="info"
+        inhibit_rules:
+          - source_matchers:
+              - severity="critical"
+            target_matchers:
+              - severity="warning"
+            equal: ["alertname", "job"]
+        receivers:
+          - name: blackhole
+          - name: telegram
+            telegram_configs:
+              - bot_token_file: /etc/vm/secrets/alertmanager-telegram/bot_token
+                chat_id_file: /etc/vm/secrets/alertmanager-telegram/chat_id
+                send_resolved: true
 
     grafana:
       enabled: true