feat: AlertManager Matrix integration with severity routing

Deploy matrix-alertmanager-receiver bridge (pending bot credentials in
OpenBao). Update AlertManager routing: critical → Matrix + email,
warning → Matrix only, Watchdog → null. Reduce repeat interval to 4h.

base/monitoring/prometheus-values.yaml

@@ -138,13 +138,35 @@ alertmanager:
       group_by: [alertname, namespace]
       group_wait: 30s
       group_interval: 5m
-      repeat_interval: 12h
-      receiver: email
+      repeat_interval: 4h
+      receiver: matrix
+      routes:
+        - matchers:
+            - alertname = Watchdog
+          receiver: "null"
+        - matchers:
+            - severity = critical
+          receiver: critical
+        - matchers:
+            - severity = warning
+          receiver: matrix
     receivers:
+      - name: "null"
       - name: email
         email_configs:
           - to: "ops@DOMAIN_SUFFIX"
             send_resolved: true
+      - name: matrix
+        webhook_configs:
+          - url: "http://matrix-alertmanager-receiver.monitoring.svc.cluster.local:3000/alerts"
+            send_resolved: true
+      - name: critical
+        webhook_configs:
+          - url: "http://matrix-alertmanager-receiver.monitoring.svc.cluster.local:3000/alerts"
+            send_resolved: true
+        email_configs:
+          - to: "ops@DOMAIN_SUFFIX"
+            send_resolved: true
 
 # Disable monitors for components k3s doesn't expose
 kubeEtcd: