feat: add Prometheus + Grafana + Portainer, remove Netdata

- Replace Netdata with Prometheus + Node Exporter + cAdvisor + Grafana
- Add Portainer CE for container management
- metrics.carloselugo.com now serves Grafana
- portainer.carloselugo.com added behind internal_only snippet
- Prometheus internal only, no public port exposed
- Retention: 15d
- Dashboards: Node Exporter Full (1860), cAdvisor (14282)

Caddyfile

@@ -1,6 +1,9 @@
 # ── Global options ─────────────────────────────────────────────────────────────
 {
 	debug
+	servers {
+		protocols h1 h2
+	}
 }
 
 # ── Snippets reutilizables ─────────────────────────────────────────────────────
@@ -18,7 +21,7 @@
 	basic_auth {
 		carlos $2a$14$6MgHKR/jLD..MFkuNo0i1OBs.wwZOntIDiYsYpsyyH./OCKa8SoGS
 	}
-	@blocked not remote_ip 24.139.235.46/32 192.168.68.0/24 2605:ba00:3108::/48 74.115.203.2/32
+	@blocked not remote_ip 24.139.235.46/32 192.168.68.0/24 2605:ba00:3108::/48 74.115.203.2/32 165.225.192.0/18
 	abort @blocked
 }
 
@@ -45,12 +48,12 @@ uptime.carloselugo.com {
 	}
 }
 
-# ── Netdata — protegido, info sensible ────────────────────────────────────────
+# ── Grafana — metrics.carloselugo.com ─────────────────────────────────────────
 metrics.carloselugo.com {
 	import internal_only
 	import security_headers
 	header X-Frame-Options "SAMEORIGIN"
-	reverse_proxy netdata:19999
+	reverse_proxy grafana:3000
 	encode gzip
 	log {
 		output file /var/log/caddy/metrics.log
@@ -58,6 +61,19 @@ metrics.carloselugo.com {
 	}
 }
 
+# ── Portainer — portainer.carloselugo.com ─────────────────────────────────────
+portainer.carloselugo.com {
+	import internal_only
+	import security_headers
+	header X-Frame-Options "SAMEORIGIN"
+	reverse_proxy portainer:9000
+	encode gzip
+	log {
+		output file /var/log/caddy/portainer.log
+		format json
+	}
+}
+
 # ── Umami Analytics ───────────────────────────────────────────────────────────
 analytics.carloselugo.com {
 	import security_headers
@@ -73,7 +89,7 @@ analytics.carloselugo.com {
 	}
 
 	handle {
-		@blocked not remote_ip 24.139.235.46/32 192.168.68.0/24 2605:ba00:3108::/48 74.115.203.2/32
+		@blocked not remote_ip 24.139.235.46/32 192.168.68.0/24 2605:ba00:3108::/48 74.115.203.2/32 165.225.192.0/18
 		abort @blocked
 		reverse_proxy umami:3000
 	}