feat(monitoring): in-cluster app-health probe for paperless

paperless.renner.uno is served entirely through the paperless-gate
Authentik outpost. gatus already records the consequence at
apps/gatus/configmap.yaml:176-185: every path including /api/ answers
302 to an unauthenticated caller, so its check of that hostname — and
the UptimeRobot monitor REN-2 adds — is reachability only and stays
green while paperless is dead behind a live gate. This adds the app
health half of the pair, from the in-cluster vantage.

The target is /accounts/login/ because paperless-ngx has no
unauthenticated health endpoint. It is the app's own established
"the webserver answers" signal — the path its startup, liveness and
readiness probes already use — and it renders a Django view rather
than a static file. It does not cover the consumer/celery workers,
and the comment says so.

No CiliumNetworkPolicy change, and no edit to the paperless namespace.
The gatus comment above asserts an in-cluster probe needs one first;
that was written for gatus, which runs in `apps`. paperless-ns.yaml:24-26
already admits the whole monitoring namespace, where blackbox-exporter
runs, and Cilium unions the allow rules of every CNP selecting an
endpoint — the same mechanism apps/paperless/network-policy.yaml:8-12
relies on.

No PrometheusRule change: the target is covered by the existing
BlackboxProbeFailing catch-all and is correctly absent from its
exclusion list, which per prometheusrule-blackbox.yaml:18-33 holds only
instances that have a dedicated rule elsewhere.

Refs REN-21.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

kubernetes/apps/monitoring-rules/probes-blackbox.yaml

@@ -117,6 +117,35 @@ spec:
         # loop BEFORE it has read the API key out of config.xml.
         - http://navidrome.navidrome.svc.cluster.local:80/ping
         - http://lidarr.navidrome.svc.cluster.local:80/ping
+        # APP-HEALTH probe for paperless. Same rule as the block above
+        # (monitoring-vantage-point-rule); the blind spot it closes is the one
+        # gatus already documents at apps/gatus/configmap.yaml:176-185 —
+        # through the paperless-gate outpost EVERY path, /api/ included,
+        # answers 302 to an unauthenticated caller, so no external probe of
+        # paperless.renner.uno can tell a live app from a live gate. That
+        # external signal is still wanted, and REN-2 adds it from UptimeRobot;
+        # this is the other half of the pair.
+        #
+        # That gatus comment says the in-cluster probe "needs a
+        # CiliumNetworkPolicy first". It does not, for THIS prober — the
+        # sentence was written for gatus, which runs in `apps`.
+        # paperless-ns.yaml:24-26 already admits the whole monitoring
+        # namespace, which is where blackbox-exporter runs, and Cilium unions
+        # the allow rules of every CNP selecting an endpoint (the mechanism
+        # apps/paperless/network-policy.yaml:8-12 relies on). Nothing in the
+        # paperless namespace is edited by this change.
+        #
+        # /accounts/login/ because paperless-ngx has no unauthenticated health
+        # endpoint at all. It is the app's own established "the webserver
+        # answers" signal — the same path its startup, liveness and readiness
+        # probes use (paperless.yaml:252-272) — and it renders a Django view
+        # rather than a static file. It does NOT cover the consumer/celery
+        # workers: see process-liveness-vs-protocol-liveness.
+        #
+        # The cluster-local Host header is accepted only because
+        # PAPERLESS_ALLOWED_HOSTS is "*" (paperless.yaml:27). Narrow that and
+        # Django answers 400 here and this probe goes permanently red.
+        - http://paperless.paperless.svc.cluster.local:80/accounts/login/
 # WAN-path probes of the public edge BY PROXY IP. The name-based
 # home.renner.uno probe above resolves in-cluster (CoreDNS/k8s_gateway)
 # and never leaves the LAN — the vantage-point blind spot that let the