Add UnPoller for UniFi network metrics (#298)

## Summary
- Deploy UnPoller as a k8s service on indri to export UniFi controller metrics to Prometheus
- Custom-built container from forge mirror (`containers/unpoller/Dockerfile`)
- Credentials pulled from 1Password via external-secrets
- Prometheus scrape job added, docs and service-versions updated

## Test plan
- [ ] Build container: `mise run container-release unpoller v2.34.0`
- [ ] Update kustomization tag with built image tag
- [ ] Deploy from branch: `argocd app set unpoller --revision feature/unpoller && argocd app sync unpoller`
- [ ] Verify pod connects to UX7 controller (check logs)
- [ ] Confirm `unpoller` target appears in Prometheus
- [ ] Query `unifi_` metrics in Grafana

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Reviewed-on: #298

docs/changelog.d/feature-unpoller.feature.md

@@ -0,0 +1 @@
+Add UnPoller deployment to monitor UniFi network metrics via Prometheus

docs/reference/infrastructure/unifi.md

@@ -1,6 +1,6 @@
 ---
 title: UniFi
-modified: 2026-02-24
+modified: 2026-03-16
 tags:
   - infrastructure
   - networking
@@ -69,6 +69,14 @@ Local admin account on the UX7. Credentials stored in 1Password (vault `blumeops
 
 Attempted Feb 2026 with the `ubiquiti-community/unifi` Terraform provider via Pulumi. A "no-op" update on the default LAN network reset undeclared properties, bricking the network and requiring a factory reset. The provider ecosystem is too immature for single-device infrastructure.
 
+## Monitoring
+
+UniFi metrics are exported to Prometheus via [UnPoller](https://github.com/unpoller/unpoller), running as a k8s deployment in the `monitoring` namespace on indri. UnPoller polls the UX7 controller API using an API key and exposes metrics on port 9130.
+
+- **Prometheus job:** `unpoller`
+- **Metrics prefix:** `unifi_`
+- **Credentials:** 1Password item `unpoller` (vault `blumeops`, API key)
+
 ## Related
 
 - [[hosts]] — Device inventory