feat(k8s): NodePort service for external Prometheus scraping

A dedicated Prometheus at 10.0.15.25 on the private network can now
scrape the cluster via `<any-node-ip>:30090/metrics`. Scrape rotates
across pods; BEAM metrics stay representative as a sample and the
oban queue-depth gauge reads from the shared DB so all pods report
the same value.

k8s/kustomization.yaml

@@ -8,3 +8,4 @@ resources:
   - rbac.yaml
   - deployment.yaml
   - service.yaml
+  - metrics-service.yaml

k8s/metrics-service.yaml

@@ -0,0 +1,25 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: prop-metrics
+  namespace: prop
+  labels:
+    app: prop
+    purpose: metrics
+spec:
+  type: NodePort
+  # Don't pin scrapes to a single pod — we want Prometheus to sample
+  # across all replicas so BEAM-level metrics (memory, scheduler util)
+  # stay representative. DB-backed gauges (oban queue depth) are
+  # identical across pods so per-scrape rotation is fine there too.
+  sessionAffinity: None
+  selector:
+    app: prop
+  ports:
+    - name: metrics
+      # Fixed high-numbered NodePort so the external Prometheus at
+      # 10.0.15.25 can scrape `nodeIP:30090` without needing k8s SD.
+      nodePort: 30090
+      port: 5000
+      targetPort: 5000
+      protocol: TCP