review: full per-member/family edge coverage; DNS is the member truth

The review flagged the v6 target as 'proxy-2 per unifi_nat_hairpin.tf'.
The tf label keys are the swapped ones: DNS (dig) and the live hosts
(the v6-only member with the nameserver-less dhcpcd lease answers as
proxy-1.renner.uno = 2a03:…:28:f6e…; the dual-stack member answers as
proxy-2.renner.uno = 45.157.177.26 + 2a03:…:4b:c1e…) both agree with
the probe's original attribution, as does the netbird-proxy role's
'proxy-1 is v6-only' doc. Keep DNS attribution, document the tf
mislabel (tracked for a separate relabel — renaming those tf map keys
churns NAT rule resources, so it doesn't belong in this PR), and:

- add proxy-2's v6 address as a third target (previously its v6 path
  was unprobed; verified live from a pod, returns 200)
- pin job="blackbox-http" on NetbirdControllerUnreachable for
  consistency with the other rules

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

kubernetes/apps/monitoring-rules/probes-blackbox.yaml

@@ -83,8 +83,18 @@ spec:
   targets:
     staticConfig:
       static:
-        # proxy-2 v4
+        # Member attribution follows DNS, which is the operational truth
+        # (verified 2026-07-26: dig + live ssh — the v6-only host with
+        # the dhcpcd/no-IPv4 lease is proxy-1.renner.uno = 2a03:…:28:f6e…;
+        # proxy-2.renner.uno is the dual-stack member). NOTE: the label
+        # keys in opentofu/unifi_nat_hairpin.tf have the two v6
+        # addresses attributed to the OPPOSITE members — tracked for a
+        # separate relabel; the addresses themselves are hairpinned
+        # identically, so nothing was functionally wrong there.
+        # proxy-2 v4 (dual-stack member)
         - https://45.157.177.26
+        # proxy-2 v6
+        - https://[2a03:4000:4b:c1e:4474:43ff:fedf:8f85]
         # proxy-1 v6 (v6-only member)
         - https://[2a03:4000:28:f6e:a4c7:59ff:fe1e:9a29]
 ---

kubernetes/apps/monitoring-rules/prometheusrule-netbird-availability.yaml

@@ -17,7 +17,7 @@ spec:
           # survive) — but peer logins, route changes, the dashboard and
           # emergency access depend on it, and the 2026-07-24 DC outage
           # ran ~20 h with no signal.
-          expr: probe_success{instance="https://netbird.renner.uno"} == 0
+          expr: probe_success{job="blackbox-http", instance="https://netbird.renner.uno"} == 0
           for: 10m
           labels:
             severity: critical
@@ -36,7 +36,7 @@ spec:
             severity: critical
           annotations:
             summary: "Public edge unreachable from the WAN (all members)"
-            description: "Both IP-pinned WAN-path probes of the reverse-proxy edge (proxy-2 v4, proxy-1 v6) have failed for 5 minutes — external clients cannot reach home.renner.uno and the other published apps. Check the netcup proxies (netbird-proxy containers), the mesh path to the cluster, and cluster Traefik."
+            description: "All IP-pinned WAN-path probes of the reverse-proxy edge (proxy-2 v4+v6, proxy-1 v6) have failed for 5 minutes — external clients cannot reach home.renner.uno and the other published apps. Check the netcup proxies (netbird-proxy containers), the mesh path to the cluster, and cluster Traefik."
 
         - alert: NetbirdPublicEdgeMemberDown
           # A single edge member failing WAN reachability: DNS round-robin