Add a prometheus.scrape for the CrowdSec agent's :6060 endpoint, forwarded to the existing remote_write. CrowdSec runs on the host, so nodes that run it bind the metrics endpoint on 0.0.0.0 (host firewall keeps it off the public interface) and Alloy reaches it via the docker gateway; nodes without CrowdSec report the target down. node/instance labels are stamped APEX_NODE_HOST like the other exporters.