feat(uptime-kuma): add outbound availability checks with Discord alerts

[PragalvaXFREZ]

What

Adds Uptime Kuma to devata as a workload Application in namespace uptime.

• Chart uptime-kuma 4.2.0 (app 2.5.0) from helm.irsigler.cloud, values in kubernetes/apps/uptime-kuma/values.yaml. Renovate covers the pin through the existing Argo CD manager patterns.
• 1Gi Longhorn PVC declared in the repo and passed to the chart as existingClaim, so class and labels stay under Git.
• Recreate strategy, because a single replica with a ReadWriteOnce volume cannot roll.
• Pinned to talos-lqv-w4u by hostname (most memory headroom). Requests 50m/128Mi, memory limit 256Mi, no CPU limit.
• Security context: seccomp RuntimeDefault, no privilege escalation, drop ALL, add NET_RAW for ping monitors. Image is root; baseline PSA permits it.
• CiliumNetworkPolicy: egress to kube-dns, TCP 80/443 to world, ICMP echo to world. Ingress only from the ingress entity (LAN Gateway Envoy). Chart's generic NetworkPolicy disabled.
• Component README with safety model, verification, rollback, and limitations. Root README map gains the new app directory.

What this deliberately does not do

• No Velero Schedule. kubernetes/infra/storage/velero/README.md records a no-unattended-schedule contract against the 1 GB R2 ceiling. The README points at the on-demand path instead.
• No public exposure. A LAN Gateway route for kuma.lab.pragalva.me follows in a separate PR.

Validation

• helm template with the repo values renders cleanly.
• kubeconform -strict passes on the Application, PVC, CiliumNetworkPolicy, and the rendered chart output.
• python3 scripts/check-docs.py passes.

After merge

1. kubectl -n uptime get deploy,pod,pvc,cnp and confirm the pod is on talos-lqv-w4u with a Bound Longhorn volume and two healthy replicas.
2. Port-forward, create the admin account, add the Discord webhook, add one HTTP monitor.
3. Add a TCP monitor on a port outside 80/443 and confirm it stays red. That proves the policy is enforced.