fix(alerts): exclude netbird streams from traefik latency alert

SignalExchange ConnectStream holds 60s gRPC streams by design; at night they exceed 5% of samples and pin P95 to the 5.0s bucket ceiling, flapping the alert. Also fixes the stale xui exclusion pattern, which matched no real service label.

prometheus-stack/k8s/traefik-alerts.yaml

@@ -42,7 +42,7 @@ spec:
         - alert: TraefikServiceHighLatency
           expr: |
             histogram_quantile(0.95,
-              sum(rate(traefik_service_request_duration_seconds_bucket{service!~"xui-xui-service-.*"}[5m])) by (le, service)) > 2
+              sum(rate(traefik_service_request_duration_seconds_bucket{service!~"xui-service|netbird-server-service"}[5m])) by (le, service)) > 2
           for: 5m
           labels:
             severity: warning