backend: GDPR export + retention cleanups + worker metrics (BE-1/2/3)

BE-3 observability: expose the worker's Prometheus metrics on :6060/metrics
(apns/fcm/asynq histograms + a new cache_ops_total counter were recorded all
along but never scraped — which is why those dashboard panels read empty); add
the worker containerPort, the vmagent worker scrape job, and two additive
NetworkPolicies. Instrument cache Get/Set hit/miss.

BE-2 retention: three periodic Asynq cleanup crons mirroring the reminder-log
cleanup — notifications (90d), webhook dedup log (180d), audit_log (365d).

BE-1 GDPR data export: POST /api/auth/export/ enqueues a low-priority Asynq job
that gathers all of the user's data (owned residences + their tasks/contractors/
documents/share-codes, plus profile/notifications/prefs/push-tokens/subscription/
audit log), zips one JSON file per category, and emails it as an attachment.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

deploy-k3s/manifests/observability/vmagent.yaml

@@ -78,18 +78,25 @@ data:
           - target_label: service
             replacement: node-exporter
 
-      # honeyDue worker — also exposes /metrics if/when we add it.
-      # Keep this stanza commented until the worker has a /metrics endpoint;
-      # uncommented form drops scrapes silently.
-      # - job_name: worker
-      #   kubernetes_sd_configs:
-      #     - role: pod
-      #       namespaces:
-      #         names: [honeydue]
-      #   relabel_configs:
-      #     - source_labels: [__meta_kubernetes_pod_label_app_kubernetes_io_name]
-      #       action: keep
-      #       regex: worker
+      # honeyDue worker — exposes /metrics on :6060 (apns/fcm/asynq/cache series).
+      - job_name: worker
+        kubernetes_sd_configs:
+          - role: pod
+            namespaces:
+              names: [honeydue]
+        relabel_configs:
+          - source_labels: [__meta_kubernetes_pod_label_app_kubernetes_io_name]
+            action: keep
+            regex: worker
+          - source_labels: [__meta_kubernetes_pod_container_port_number]
+            action: keep
+            regex: "6060"
+          - source_labels: [__meta_kubernetes_pod_name]
+            target_label: pod
+          - source_labels: [__meta_kubernetes_pod_node_name]
+            target_label: node
+          - target_label: service
+            replacement: worker
 
 ---
 apiVersion: v1