feat: AlertManager Matrix integration with severity routing

Deploy matrix-alertmanager-receiver bridge (pending bot credentials in
OpenBao). Update AlertManager routing: critical → Matrix + email,
warning → Matrix only, Watchdog → null. Reduce repeat interval to 4h.

base/monitoring/matrix-alertmanager-receiver-deployment.yaml

@@ -0,0 +1,65 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: matrix-alertmanager-receiver
+  namespace: monitoring
+  labels:
+    app: matrix-alertmanager-receiver
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: matrix-alertmanager-receiver
+  template:
+    metadata:
+      labels:
+        app: matrix-alertmanager-receiver
+    spec:
+      containers:
+        - name: receiver
+          image: ghcr.io/metio/matrix-alertmanager-receiver:2024.11.27
+          ports:
+            - containerPort: 3000
+              protocol: TCP
+          env:
+            - name: MAR_HOMESERVER_URL
+              value: "http://tuwunel.matrix.svc.cluster.local:6167"
+            - name: MAR_USER_ID
+              value: "@alertbot:sunbeam.pt"
+            - name: MAR_ACCESS_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: matrix-bot-creds
+                  key: access_token
+            - name: MAR_ROOM_MAPPING
+              value: "ops=$(ROOM_ID)"
+            - name: ROOM_ID
+              valueFrom:
+                secretKeyRef:
+                  name: matrix-bot-creds
+                  key: room_id
+            - name: MAR_PORT
+              value: "3000"
+          resources:
+            requests:
+              cpu: 10m
+              memory: 32Mi
+            limits:
+              memory: 64Mi
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: matrix-alertmanager-receiver
+  namespace: monitoring
+  labels:
+    app: matrix-alertmanager-receiver
+spec:
+  type: ClusterIP
+  ports:
+    - port: 3000
+      targetPort: 3000
+      protocol: TCP
+  selector:
+    app: matrix-alertmanager-receiver