feat(ingress): replace traefik crowdsec plugin with firewall bouncer

Move L3 enforcement to the host firewall-bouncer (systemd, nftables): drop the Traefik plugin, its secrets volume and the crowdsec Middleware, remove bouncer refs from all IngressRoutes. Disable the http-generic-bf scenario (403-burst bans hurt legit automation under L3 enforcement). Add a Gateway API PoC for homepages prod and CrowdSec PrometheusRule alerts.

prometheus-stack/k8s/crowdsec-alerts.yaml

@@ -0,0 +1,41 @@
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  name: crowdsec
+  namespace: prometheus
+  labels:
+    release: prometheus-stack
+spec:
+  groups:
+    - name: crowdsec
+      rules:
+        - alert: CrowdsecFirewallBouncerStale
+          expr: |
+            absent(cs_lapi_bouncer_requests_total{bouncer="firewall-workstation"})
+            or sum(rate(cs_lapi_bouncer_requests_total{bouncer="firewall-workstation"}[10m])) == 0
+          for: 15m
+          labels:
+            severity: critical
+          annotations:
+            summary: "Firewall bouncer stopped pulling decisions"
+            description: "No LAPI pulls from firewall-workstation for 15 minutes. L3 enforcement is decaying: existing bans expire, new ones never land. Check the systemd unit on the node."
+
+        - alert: CrowdsecDecisionsSpike
+          expr: |
+            sum(cs_active_decisions) - sum(cs_active_decisions offset 30m) > 20
+          for: 5m
+          labels:
+            severity: warning
+          annotations:
+            summary: "Spike in active CrowdSec decisions"
+            description: "Active decisions grew by more than 20 in 30 minutes (current: {{ $value }}). Possible ban storm or self-ban - check cscli decisions list."
+
+        - alert: CrowdsecLAPIDecisionErrors
+          expr: |
+            sum(rate(cs_lapi_decisions_ko_total[5m])) > 0
+          for: 10m
+          labels:
+            severity: warning
+          annotations:
+            summary: "CrowdSec LAPI decision errors"
+            description: "LAPI is failing decision lookups. Bouncers may be failing open. Check LAPI logs and DB health."