fix(monitoring): mount prometheus/alertmanager config dirs, not single files

Deploying e0808ba surfaced the trap in practice: docker pins a single-file bind
mount to the inode, git pull replaces files by rename, so the container kept
serving the old alerts.yml while SIGHUP reported a successful reload — host and
container md5 differed and BackupCronJobMissing simply was not there.

The trap was already documented in this README, in detail, with the correct
command and a verification snippet, and it still bit. A footgun you avoid only by
reading gets stepped on eventually, so remove it structurally: directory mounts
resolve through the path on every access. Config paths are unchanged, so
--config.file keeps working. Remaining single-file mounts (loki, alloy, the
scripts) are named in the README as still needing --force-recreate.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

monitoring/docker-compose.yml

@@ -4,8 +4,12 @@ services:
     container_name: prometheus
     restart: unless-stopped
     volumes:
-      - ./prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
-      - ./prometheus/alerts.yml:/etc/prometheus/alerts.yml:ro
+      # Verzeichnis- statt Einzeldatei-Mount: Docker haengt Einzeldatei-Mounts am
+      # Inode auf, und `git pull` ersetzt Dateien per Rename (neuer Inode) - der
+      # Container sah die Aenderung dann nie, waehrend SIGHUP brav Erfolg meldete.
+      # Verzeichnis-Mounts loesen bei jedem Zugriff ueber den Pfad auf.
+      # Config-Pfade bleiben unveraendert (--config.file zeigt weiter dorthin).
+      - ./prometheus:/etc/prometheus:ro
       - prometheus_data:/prometheus
     command:
       - '--config.file=/etc/prometheus/prometheus.yml'
@@ -26,7 +30,10 @@ services:
     container_name: alertmanager
     restart: unless-stopped
     volumes:
-      - ./alertmanager/alertmanager.yml:/etc/alertmanager/alertmanager.yml:ro
+      # Verzeichnis-Mount, gleicher Grund wie bei Prometheus. Die beiden .py aus
+      # diesem Ordner liegen dadurch mit unter /etc/alertmanager - ungenutzt und
+      # harmlos, alertmanager laedt ausschliesslich --config.file.
+      - ./alertmanager:/etc/alertmanager:ro
       - alertmanager_data:/alertmanager
     command:
       - '--config.file=/etc/alertmanager/alertmanager.yml'