observability: give Dankserver its node-exporter back as a Quadlet

Dankserver's node-exporter has been dead since a reboot: `podman ps -a` showed
it `Exited (143)` and Prometheus' `node-dankserver` job has been scraping
nothing. It ran only from `dankserver/compose.yaml`, which is the failure mode
this repository's boot-persistence rule exists for (rootless Podman does not
restart bare containers after the stop that shutdown performs), and the compose
form bound the wildcard address — the unauthenticated-metrics-API-on-every-
interface posture already removed on Dankclaw.

  - dankserver/observability/quadlet/node-exporter.container — mirrors the
    Dankclaw unit, listening on exactly 127.0.0.1:9100 (host-local probes) and
    192.168.0.235:9100 (Prometheus on Dankclaw), with Restart=always and
    WantedBy=default.target.
  - the compose service is deleted: one owner per container name.
  - deploy_observability now installs from "$TARGET/observability/quadlet"; it
    hardcoded the Dankclaw path, so a Dankserver unit could not be installed by
    the shared dispatcher at all.
  - planner: "node-exporter" joins the Dankserver service set, with a path rule
    for dankserver/observability/**; the dispatcher's allowlist gains
    dankserver:node-exporter.

Seams cover the silent halves: both listen addresses present and the wildcard
absent, the compose service gone, the allowlist entry present, and the planner
mapping the path to the service.

dankserver/observability/quadlet/node-exporter.container

@@ -0,0 +1,58 @@
+# Quadlet unit: node-exporter (rootless, boot-persistent) — DANKSERVER.
+#
+# Install path on dankserver: ~/.config/containers/systemd/node-exporter.container
+# Unit name: node-exporter.service (container name: node-exporter)
+#
+# WHY THIS FILE EXISTS. Until 2026-09-16 the Dankserver node-exporter ran only
+# from `dankserver/compose.yaml` (the "Observability" block, `restart:
+# unless-stopped`). Rootless Podman does not restart bare containers after the
+# explicit stop that shutdown performs, so it died at a reboot and stayed dead:
+# `podman ps -a` showed it `Exited (143)` and Prometheus' `node-dankserver` job
+# had been scraping nothing since. The compose entry also bound the default
+# wildcard address, which is the unauthenticated-metrics-API-on-every-interface
+# posture that was already removed on Dankclaw. This unit replaces both: one
+# owner per container name (the compose service is deleted), explicit listen
+# addresses, and a generator-provided boot path.
+#
+# HOST NAMESPACE. Networking and PID in the host's namespaces: the collectors
+# report the host's own interfaces, connections, processes and cgroups. The
+# host's /proc, /sys and / are mounted read-only under /host and /rootfs, and
+# node_exporter writes nothing.
+#
+# LISTEN ADDRESSES. Exactly two:
+#   - 127.0.0.1:9100   for host-local probes
+#   - 192.168.0.235:9100 for Prometheus, which scrapes this host from Dankclaw
+#     (shared/prometheus/prometheus.yml, job "node-dankserver"). It cannot use
+#     loopback across hosts, and node_exporter has no authentication, so the
+#     wildcard bind stays off the table. This is the same deliberate LAN
+#     listener posture the observability runbook documents.
+#
+# MIRROR. Keep this file in step with dankclaw/observability/quadlet/
+# node-exporter.container; only the Description and the LAN address differ.
+
+[Unit]
+Description=Prometheus node exporter (Dankserver host metrics)
+After=network-online.target
+Wants=network-online.target
+
+[Container]
+ContainerName=node-exporter
+Image=docker.io/prom/node-exporter:latest
+Network=host
+PodmanArgs=--pid=host
+Exec=--path.procfs=/host/proc --path.sysfs=/host/sys --path.rootfs=/rootfs --web.listen-address=127.0.0.1:9100 --web.listen-address=192.168.0.235:9100
+Volume=/proc:/host/proc:ro
+Volume=/sys:/host/sys:ro
+Volume=/:/rootfs:ro
+HealthCmd=wget --spider -q http://localhost:9100/metrics
+HealthInterval=30s
+HealthTimeout=10s
+HealthRetries=3
+HealthStartPeriod=30s
+
+[Service]
+Restart=always
+RestartSec=10
+
+[Install]
+WantedBy=default.target