Replace shared redis-exporter VMPodScrape with per-app scrapes

Per review: drop the cross-namespace label-selector approach. Each app now
carries its own VMPodScrape next to its redis/valkey manifests, selecting on
the deployment's existing pod labels (mirroring the arrstack exportarr
pattern), so no opt-in monitoring.unkin.net/redis-exporter label is needed.

- Remove the monitoring.unkin.net/redis-exporter pod label from the
  artifactapi/authentik/litellm redis and gitea/netbox valkey deployments
- Delete apps/base/observability/vmpodscrape-redis.yaml
- Add a local-namespace VMPodScrape (port metrics, path /metrics) to
  artifactapi, authentik, litellm (app=redis), gitea (app=gitea-valkey),
  netbox (app=netbox-valkey), and jellyfin (valkey-operator node labels)

apps/base/netbox/kustomization.yaml

@@ -10,6 +10,7 @@ resources:
   - valkey-deployment.yaml
   - valkey-pvc.yaml
   - valkey-service.yaml
+  - vmpodscrape.yaml
   - vaultauth.yaml
   - vaultstaticsecret.yaml
   - gateway.yaml

apps/base/netbox/valkey-deployment.yaml

@@ -27,7 +27,6 @@ spec:
         app: netbox-valkey
         app.kubernetes.io/name: netbox
         app.kubernetes.io/component: valkey
-        monitoring.unkin.net/redis-exporter: "true"
     spec:
       securityContext:
         fsGroup: 999

apps/base/netbox/vmpodscrape.yaml

@@ -0,0 +1,16 @@
+---
+# Scrape the redis_exporter sidecar (:9121) on the netbox-valkey pod. Picked up
+# by the observability VMAgent (selectAllByDefault). Pod-level rather than
+# VMServiceScrape because the valkey Service doesn't expose the metrics port.
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMPodScrape
+metadata:
+  name: valkey-exporter
+  namespace: netbox
+spec:
+  selector:
+    matchLabels:
+      app: netbox-valkey
+  podMetricsEndpoints:
+    - port: metrics
+      path: /metrics