feat(monitoring): surveillance réseau active via blackbox_exporter

Sondes actives ICMP/HTTP/DNS qui complètent le monitoring passif
(node_exporter + up{}) : joignabilité hôtes/passerelle, accès internet,
santé DNS *.lab.local + forwarding, latence LAN, services de bout en
bout via Traefik.

- blackbox_exporter (chart 11.13.0, ArgoCD, ns monitoring) — ICMP via
  NET_RAW, DNS du pod = dnsmasq (chemin réel lab → Traefik)
- 3 jobs blackbox-icmp/-http/-dns (additionalScrapeConfigs)
- alerts-network.yaml : internet, DNS, passerelle, hôtes, services,
  latence, exporter (→ pipeline AlertManager existant)
- Asa : outil network_status + contexte présélectionnable reseau
- doc admin/infra/reseau.md + CLAUDE.md + progress

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Rc3dLKfqEPHexvFCCx5ZEF

k8s/infra/monitoring/values.yaml

@@ -81,6 +81,82 @@ prometheus:
               model: qwen3-8b
               type: gpu
 
+      # --- Sondes réseau actives (blackbox_exporter) ---
+      # Le relabeling envoie la cible réelle en ?target=… et fait pointer le
+      # scrape vers le service blackbox. Cf. admin/infra/reseau.md.
+      - job_name: blackbox-icmp
+        metrics_path: /probe
+        params:
+          module: [icmp]
+        static_configs:
+          - targets:
+              - 192.168.10.1     # storage-01 — passerelle / NAT / DNS
+              - 192.168.10.11    # compute-01 (control-plane)
+              - 192.168.10.12    # compute-02
+              - 192.168.10.13    # compute-03
+              - 192.168.10.20    # gpu-01
+            labels:
+              scope: lan
+          - targets:
+              - 1.1.1.1          # Cloudflare — joignabilité internet
+              - 9.9.9.9          # Quad9 — joignabilité internet
+            labels:
+              scope: internet
+        relabel_configs:
+          - source_labels: [__address__]
+            target_label: __param_target
+          - source_labels: [__param_target]
+            target_label: instance
+          - target_label: __address__
+            replacement: blackbox-exporter.monitoring.svc.cluster.local:9115
+
+      - job_name: blackbox-http
+        metrics_path: /probe
+        params:
+          module: [http_2xx]
+        static_configs:
+          - targets:
+              - http://grafana.lab.local
+              - http://prometheus.lab.local
+              - http://alertmanager.lab.local
+              - http://argocd.lab.local
+              - http://openwebui.lab.local
+              - http://n8n.lab.local
+              - http://ghostfolio.lab.local
+              - http://searxng.lab.local
+              - http://stt.lab.local
+            labels:
+              scope: ingress
+        relabel_configs:
+          - source_labels: [__address__]
+            target_label: __param_target
+          - source_labels: [__param_target]
+            target_label: instance
+          - target_label: __address__
+            replacement: blackbox-exporter.monitoring.svc.cluster.local:9115
+
+      # DNS : module choisi par cible (label module → __param_module), serveur
+      # interrogé = dnsmasq (192.168.10.1:53). dns_lab teste le wildcard
+      # *.lab.local, dns_external teste le forwarding vers l'upstream.
+      - job_name: blackbox-dns
+        metrics_path: /probe
+        static_configs:
+          - targets: ['192.168.10.1:53']
+            labels:
+              module: dns_lab
+              instance: 'dnsmasq:grafana.lab.local'
+          - targets: ['192.168.10.1:53']
+            labels:
+              module: dns_external
+              instance: 'dnsmasq:one.one.one.one'
+        relabel_configs:
+          - source_labels: [module]
+            target_label: __param_module
+          - source_labels: [__address__]
+            target_label: __param_target
+          - target_label: __address__
+            replacement: blackbox-exporter.monitoring.svc.cluster.local:9115
+
 alertmanager:
   ingress:
     enabled: true