fix(monitoring): scrape node-dankclaw via host.containers.internal

node-exporter is net=host, so its 192.168.0.143:9100 bind is a host bind,
not a published port — the bridge-networked Prometheus container cannot
reach its own host's LAN IP there (netavark DNATs published ports only).
The node-dankclaw target has been red by construction since the
observability cutover while the container reported healthy. Point it at
host.containers.internal:9100 (netavark delivers that to the host LAN IP,
where node-exporter listens) — the same rule frank-large and frank-small
already use. node-dankserver is a different machine and keeps its LAN
address. Update the cross-file contract test and the Targets table.

shared/prometheus/prometheus.yml

@@ -27,10 +27,16 @@ scrape_configs:
     static_configs:
       - targets: ["localhost:9090"]
 
-  # Host metrics — both hosts
+  # Host metrics — both hosts. node-dankclaw is scraped over
+  # host.containers.internal, not its own LAN address: this Prometheus is a
+  # bridge container, and on this netavark host a container can only reach the
+  # host's LAN IP at a PUBLISHED port — node-exporter's net=host bind on
+  # 192.168.0.143:9100 is refused by construction (the same rule that sends
+  # frank-large and frank-small to the gateway below). node-dankserver is a
+  # different machine, so its LAN address works.
   - job_name: "node-dankclaw"
     static_configs:
-      - targets: ["192.168.0.143:9100"]
+      - targets: ["host.containers.internal:9100"]
 
   - job_name: "node-dankserver"
     static_configs: