add: actual-budget-exporter app

Prometheus exporter for Actual Budget. actual_server itself stays in
homelab-docker-compose-prod (host docker-compose), exporter only scrapes it
over LAN and exposes /metrics via a ServiceMonitor. No HTTPRoute. Password
and budget ID come from a hand-created Secret, not committed.

README.md

@@ -1,9 +1,10 @@
 # Homelab Service — Apps
 
 Third bootstrap layer, run after `cluster-bootstrap` and `cluster-platform`.
-Personal/homelab apps (not cluster infra, not shared platform tooling) — first
-one here is [Ignis](https://github.com/Nystik-gh/ignis), a self-hosted
-browser-based Obsidian.
+Personal/homelab apps (not cluster infra, not shared platform tooling) —
+[Ignis](https://github.com/Nystik-gh/ignis) (self-hosted browser-based
+Obsidian) and `actual-budget-exporter` (Prometheus exporter for a
+docker-compose-hosted Actual Budget instance).
 
 ## Architecture
 
@@ -71,3 +72,31 @@ kubectl logs -n ignis deploy/ignis   # first boot downloads Obsidian, 1-2 min
 ```
 
 Visit `http://ignis.fireflylab.local` once the pod is Ready.
+
+## actual-budget-exporter
+
+- Image: `docker.io/sakowicz/actual-budget-prometheus-exporter:latest` —
+  Prometheus exporter for [Actual Budget](https://actualbudget.org/), no
+  official Helm chart, chart here is self-authored.
+- `actual_server` itself is **not** in this cluster — it's a plain
+  docker-compose container on the homelab host
+  (`homelab-docker-compose-prod/actualbudget`), published on the host LAN IP.
+  `values.yaml` points `ACTUAL_SERVER_URL` at that host IP:port, same as
+  `actual-http-api` does in that repo.
+- No HTTPRoute — this only serves `/metrics`. A `ServiceMonitor` (labeled
+  `release: kube-prometheus-stack` to match that stack's default selector)
+  gets it scraped by the cluster Prometheus instead.
+- `ACTUAL_PASSWORD` / `ACTUAL_BUDGET_ID_1` are **not** in `values.yaml` —
+  plaintext Actual credentials don't belong in a git-committed file. They
+  come from a Secret you create by hand once, after the Application syncs
+  and the `actualbudget` namespace exists:
+
+  ```bash
+  kubectl create secret generic actual-budget-exporter-secrets \
+    -n actualbudget \
+    --from-literal=ACTUAL_PASSWORD='<your actual budget password>' \
+    --from-literal=ACTUAL_BUDGET_ID_1='<sync ID from Settings → Show advanced settings>'
+  ```
+
+  Restart the deployment after creating/rotating it:
+  `kubectl rollout restart deployment/actual-budget-exporter -n actualbudget`.