feat: scrape CrowdSec agent metrics through Alloy

Add a prometheus.scrape for the CrowdSec agent's :6060 endpoint, forwarded to the
existing remote_write. CrowdSec runs on the host, so nodes that run it bind the
metrics endpoint on 0.0.0.0 (host firewall keeps it off the public interface) and
Alloy reaches it via the docker gateway; nodes without CrowdSec report the target
down. node/instance labels are stamped APEX_NODE_HOST like the other exporters.

assets/alloy/config.alloy

@@ -68,6 +68,21 @@ prometheus.scrape "containers" {
   scrape_interval = "15s"
 }
 
+// CrowdSec agent metrics. CrowdSec runs on the host (not a container) and exposes Prometheus
+// metrics on :6060; nodes that run it bind that endpoint on 0.0.0.0 (the host firewall keeps it
+// off the public interface) so Alloy can reach it via the docker gateway. Nodes that don't run
+// CrowdSec simply report this target down.
+prometheus.scrape "crowdsec" {
+  targets = [{
+    __address__ = "host.docker.internal:6060",
+    instance    = sys.env("APEX_NODE_HOST"),
+    node        = sys.env("APEX_NODE_HOST"),
+    job         = "crowdsec",
+  }]
+  forward_to      = [prometheus.remote_write.default.receiver]
+  scrape_interval = "30s"
+}
+
 // Push metrics to the central Prometheus (needs --web.enable-remote-write-receiver).
 prometheus.remote_write "default" {
   endpoint {