新增共享 PG 的 SQL 级指标与 dev 告警分流

- 数据库主机上按实例运行 prometheus-community/postgres_exporter 0.20.1，
  以实例 OS 用户走本地 socket，经 peer + ident 映射到仅有 pg_monitor 的
  homelab_monitor 角色；无密码、不经 Bao。版本与官方 sha256sums.txt 同源。
- prod/dev 启用 pg_stat_statements；monitoring.yml 仅在未生效时 reload/重启
  （prod 走 Patroni pending restart），重复执行 changed=0。
- 告警以上游 postgres_mixin 为底改写为 PrometheusRule，阈值对齐 Patroni
  failover lag 与 max_slot_wal_keep_size；抓取目标带 env 标签。
- Alertmanager 新增 env="dev" 路由到独立 dev 频道，dev SQL 检查告警补 env。

Co-Authored-By: Claude Opus 5.5 <[email protected]>

infrastructure/shared-postgresql/ansible/monitoring.yml

@@ -0,0 +1,76 @@
+---
+# SQL 指标：激活监控所需的 HBA/ident 与 pg_stat_statements，创建只读监控角色并安装 exporter。
+# 不需要 Bao：模板先由 site.yml 写入；本 play 只做激活与验证。会重启实例（仅在预加载库未生效时），
+# 因此不放进 site.yml。重复执行应为 changed=0。
+- name: 激活实例监控配置
+  hosts: pg_hosts
+  become: true
+  gather_facts: false
+  serial: 1
+  any_errors_fatal: true
+  tasks:
+    - name: 逐实例激活
+      ansible.builtin.include_tasks: tasks/monitoring-activate.yml
+      loop: "{{ pg_instances }}"
+      loop_control:
+        loop_var: pg_instance
+
+- name: 重启 pending 的生产成员以加载 pg_stat_statements
+  hosts: pg-laptop
+  become: true
+  become_user: "{{ pg_profiles.prod.user }}"
+  gather_facts: false
+  vars:
+    pg_patronictl: [/opt/homelab-patroni/bin/patronictl, -c, "{{ pg_config_root }}/prod/patroni.yml"]
+  tasks:
+    - name: 读取集群成员状态
+      ansible.builtin.command:
+        argv: "{{ pg_patronictl + ['list', '-e', '-f', 'json'] }}"
+      register: pg_members
+      changed_when: false
+    # Patroni 在原位重启 primary，不触发 failover；写入会短暂中断，客户端需重试。
+    - name: 仅重启 pending restart 的成员
+      ansible.builtin.command:
+        argv: "{{ pg_patronictl + ['restart', 'pg-prod', '--pending', '--force'] }}"
+      when: pg_members.stdout | from_json | selectattr('Pending restart', 'equalto', '*') | list | length > 0
+      changed_when: true
+    - name: 等待两个成员恢复且无 pending
+      ansible.builtin.command:
+        argv: "{{ pg_patronictl + ['list', '-e', '-f', 'json'] }}"
+      register: pg_members_after
+      changed_when: false
+      retries: 30
+      delay: 4
+      until: >-
+        (pg_members_after.stdout | from_json | length) == 2
+        and (pg_members_after.stdout | from_json | selectattr('Pending restart', 'equalto', '*') | list | length) == 0
+        and (pg_members_after.stdout | from_json | selectattr('State', 'in', ['running', 'streaming']) | list | length) == 2
+
+- name: 创建监控角色并安装 exporter
+  hosts: pg_hosts
+  become: true
+  gather_facts: false
+  tasks:
+    - name: 下载 postgres_exporter 并校验同版本官方摘要
+      ansible.builtin.get_url:
+        url: "{{ pg_exporter_base }}/postgres_exporter-{{ pg_exporter_version }}.linux-amd64.tar.gz"
+        dest: /opt/homelab-postgres-exporter.tar.gz
+        checksum: "sha256:{{ pg_exporter_base }}/sha256sums.txt"
+        mode: '0644'
+      vars:
+        pg_exporter_base: https://github.com/prometheus-community/postgres_exporter/releases/download/v{{ pg_exporter_version }}
+      register: pg_exporter_download
+      retries: 5
+      delay: 10
+      until: pg_exporter_download is succeeded
+    - name: 解压 exporter（保留上游许可证）
+      ansible.builtin.unarchive:
+        src: /opt/homelab-postgres-exporter.tar.gz
+        dest: /opt
+        remote_src: true
+        creates: /opt/postgres_exporter-{{ pg_exporter_version }}.linux-amd64/postgres_exporter
+    - name: 逐实例配置
+      ansible.builtin.include_tasks: tasks/monitoring-exporter.yml
+      loop: "{{ pg_instances }}"
+      loop_control:
+        loop_var: pg_instance