monitoring: run node_exporter on host network

netdev (netlink) was reading the container's own veth (idle) -> node_network_*
showed ~0 on every host. Host network lets it see real host interfaces, so
bandwidth (egress vs tariff quota) works. Removed networks/expose (exclusive
with network_mode:host).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

monitoring.yml

@@ -210,6 +210,10 @@ services:
   nodeexporter:
     image: prom/node-exporter
     container_name: nodeexporter
+    # Host network so the netdev collector (netlink) reads the HOST interfaces, not
+    # the container's idle veth — required for node_network_* (bandwidth) to be real.
+    # network_mode:host is exclusive with networks/expose, so those are removed.
+    network_mode: host
     volumes:
       - /proc:/host/proc:ro
       - /sys:/host/sys:ro
@@ -220,10 +224,6 @@ services:
       - '--path.sysfs=/host/sys'
       - '--collector.filesystem.ignored-mount-points=^/(sys|proc|dev|host|etc)($$|/)'
     restart: unless-stopped
-    expose:
-      - 9100
-    networks:
-      - chains
     labels:
       - "prometheus-scrape.enabled=true"
       - "prometheus-scrape.port=9100"