新增共享 PG 的 SQL 级指标与 dev 告警分流

- 数据库主机上按实例运行 prometheus-community/postgres_exporter 0.20.1，
  以实例 OS 用户走本地 socket，经 peer + ident 映射到仅有 pg_monitor 的
  homelab_monitor 角色；无密码、不经 Bao。版本与官方 sha256sums.txt 同源。
- prod/dev 启用 pg_stat_statements；monitoring.yml 仅在未生效时 reload/重启
  （prod 走 Patroni pending restart），重复执行 changed=0。
- 告警以上游 postgres_mixin 为底改写为 PrometheusRule，阈值对齐 Patroni
  failover lag 与 max_slot_wal_keep_size；抓取目标带 env 标签。
- Alertmanager 新增 env="dev" 路由到独立 dev 频道，dev SQL 检查告警补 env。

Co-Authored-By: Claude Opus 5.5 <[email protected]>

infrastructure/shared-postgresql/ansible/roles/pg_instance/templates/patroni.yml.j2

@@ -66,6 +66,8 @@ postgresql:
     unix_socket_directories: {{ pg_socket_dir }}
     unix_socket_permissions: '0700'
     password_encryption: scram-sha-256
+    # postmaster 级参数：变更后需由 monitoring.yml 执行 Patroni pending restart。
+    shared_preload_libraries: pg_stat_statements
     shared_buffers: {{ pg_profile.shared_buffers }}
     work_mem: 4MB
     maintenance_work_mem: 64MB
@@ -76,6 +78,7 @@ postgresql:
     log_statement: none
     log_min_error_statement: panic
   pg_hba:
+    - local all {{ pg_monitor_user }} peer map=monitor
     - local all {{ pg_profile.user }} peer
     - local replication {{ pg_profile.user }} peer
     - local replication replicator scram-sha-256
@@ -88,6 +91,9 @@ postgresql:
 {% endfor %}
     - host all all 0.0.0.0/0 reject
     - host all all ::/0 reject
+  # 只有实例 OS 用户（exporter 运行身份）可映射为监控角色。
+  pg_ident:
+    - monitor {{ pg_profile.user }} {{ pg_monitor_user }}
   remove_data_directory_on_rewind_failure: false
   remove_data_directory_on_diverged_timelines: false
 watchdog:

infrastructure/shared-postgresql/ansible/roles/pg_instance/templates/pg_hba.conf.j2

@@ -1,3 +1,4 @@
+local all {{ pg_monitor_user }} peer map=monitor
 local all {{ pg_profile.user }} peer
 {% for cidr in pg_client_cidrs %}
 hostssl all all {{ cidr }} scram-sha-256

infrastructure/shared-postgresql/ansible/roles/pg_instance/templates/pg_ident.conf.j2

@@ -0,0 +1,2 @@
+# 只有实例 OS 用户（exporter 运行身份）可映射为监控角色。
+monitor {{ pg_profile.user }} {{ pg_monitor_user }}

infrastructure/shared-postgresql/ansible/roles/pg_instance/templates/postgresql.conf.j2

@@ -3,6 +3,7 @@ port = {{ pg_profile.port }}
 unix_socket_directories = '{{ pg_socket_dir }}'
 unix_socket_permissions = 0700
 hba_file = '{{ pg_config_dir }}/pg_hba.conf'
+ident_file = '{{ pg_config_dir }}/pg_ident.conf'
 password_encryption = 'scram-sha-256'
 shared_buffers = '{{ pg_profile.shared_buffers }}'
 max_connections = {{ pg_profile.max_connections }}
@@ -16,3 +17,5 @@ ssl_ca_file = '{{ pg_config_dir }}/ca.crt'
 archive_mode = off
 log_statement = none
 log_min_error_statement = panic
+# postmaster 级参数：变更后需由 monitoring.yml 重启 dev 实例。
+shared_preload_libraries = 'pg_stat_statements'