feat: monitoring — node_exporter + ROCm sysfs collector + alertmanager webhook

Ansible roles:
- node_exporter : déploie node_exporter v1.9.1 sur storage-01 et gpu-01
  avec textfile collector + services systemd. ROCm activé sur gpu-01 uniquement
  via group_vars. Collecte métriques GPU via sysfs (temp, VRAM, utilisation)
  — pas de dépendance rocm-smi (remplacé dans ROCm 7.x)
- alertmanager_webhook : service Python sur storage-01 (:9093/webhook)
  reçoit alertes AlertManager et les route vers ask-agent monitor → Hermes

Playbooks: node_exporter + alertmanager_webhook ajoutés à storage-01 et gpu-01

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ansible/roles/alertmanager_webhook/tasks/main.yml

@@ -0,0 +1,40 @@
+---
+- name: Create webhook install directory
+  ansible.builtin.file:
+    path: "{{ webhook_install_dir }}"
+    state: directory
+    owner: "{{ webhook_user }}"
+    group: "{{ webhook_user }}"
+    mode: '0755'
+
+- name: Deploy webhook script
+  ansible.builtin.copy:
+    src: webhook.py
+    dest: "{{ webhook_install_dir }}/webhook.py"
+    owner: "{{ webhook_user }}"
+    group: "{{ webhook_user }}"
+    mode: '0755'
+  notify: Restart alertmanager-webhook
+
+- name: Deploy webhook systemd service
+  ansible.builtin.template:
+    src: alertmanager-webhook.service.j2
+    dest: /etc/systemd/system/alertmanager-webhook.service
+    mode: '0644'
+  notify: Restart alertmanager-webhook
+
+- name: Enable and start alertmanager-webhook
+  ansible.builtin.systemd:
+    name: alertmanager-webhook
+    enabled: true
+    state: started
+    daemon_reload: true
+
+- name: Open webhook port in nftables
+  ansible.builtin.lineinfile:
+    path: /etc/nftables.conf
+    insertafter: '# prometheus'
+    line: "    tcp dport {{ webhook_port }} ip saddr 192.168.10.0/24 accept comment \"alertmanager-webhook\""
+    state: present
+  notify: Reload nftables
+  ignore_errors: true