Add platform infrastructure configuration

services/observability/targets/README.md

@@ -0,0 +1,24 @@
+# Platform metric targets
+
+This component declares the manually owned monitor resources and counterpart
+NetworkPolicy needed to onboard existing platform services into the home
+Prometheus instance.
+
+The owners remain authoritative for their endpoint activation:
+
+- Gitea chart: `/metrics` and its generated ServiceMonitor
+- Keycloak Operator: management metrics and its generated ServiceMonitor
+- CloudNativePG: the declared `metrics` Pod port through a manual PodMonitor
+- AIStor: the v3 per-bucket usage endpoint through a manual ServiceMonitor
+- packaged Traefik chart: its dedicated metrics Service and ServiceMonitor
+
+The AIStor endpoint uses `MINIO_PROMETHEUS_AUTH_TYPE=public`, but no public
+route is created. Port 9000 remains protected by the namespace default-deny and
+the exact Prometheus/client allow policies. Because S3 and metrics share that
+L4 port, an already-authorized S3 client can also reach the credential-less
+metrics path; HTTP-path isolation is not expressible with NetworkPolicy.
+
+The first inventory is captured before blackbox is deployed. Grafana already
+exists and must be recorded explicitly as a preexisting, verify-only substrate
+target; it is not owned or rolled back by this component.
+