relay: bind the host LAN IP, admit the podman bridge subnet only

169.254.1.2 is not a local address on this host (netavark runs its
bridges in aardvark-dns' netns), so the relay cannot bind it — and a
loopback bind refuses container traffic. Probe-socket proof: a host
socket on 192.168.0.143:18094 answers the container's 169.254.1.2:18094
dial while the LAN IP refuses from the container. The relay binds
192.168.0.143:18093 and the deployer installs an iptables INPUT pair
(ACCEPT 10.89.0.0/16, DROP rest) so the unauthenticated endpoint stays
off the LAN.

shared/prometheus/prometheus.yml

@@ -14,8 +14,8 @@ rule_files:
 
 # The delivery half. Alertmanager runs on the same dankclaw_default network,
 # so it is addressed by container name, like grafana and loki below. Its
-# single receiver webhooks the host-side signal-relay (169.254.1.2:18093,
-# the host.containers.internal endpoint).
+# single receiver webhooks the host-side signal-relay (192.168.0.143:18093,
+# reached from the container as host.containers.internal).
 alerting:
   alertmanagers:
     - static_configs: