add: actual-budget-exporter app

Prometheus exporter for Actual Budget. actual_server itself stays in
homelab-docker-compose-prod (host docker-compose), exporter only scrapes it
over LAN and exposes /metrics via a ServiceMonitor. No HTTPRoute. Password
and budget ID come from a hand-created Secret, not committed.

apps/actual-budget-exporter/chart/values.yaml

@@ -0,0 +1,35 @@
+image:
+  repository: docker.io/sakowicz/actual-budget-prometheus-exporter
+  tag: latest
+  pullPolicy: IfNotPresent
+
+replicaCount: 1
+
+service:
+  type: ClusterIP
+  port: 3001
+
+# actual_server is NOT in this cluster — it's a plain docker-compose
+# container on the homelab host (see homelab-docker-compose-prod/actualbudget),
+# published on the host LAN IP. Reach it the same way actual-http-api does.
+env:
+  ACTUAL_SERVER_URL: "http://192.168.1.41:8002"
+  # ACTUAL_BUDGET_NAME_1: ""    # optional, adds a friendly name to the prometheus label
+  # ACTUAL_E2E_PASSWORD_1: ""   # optional, only if E2E encryption is enabled on the budget
+
+# ACTUAL_PASSWORD and ACTUAL_BUDGET_ID_1 are NOT set here — plaintext Actual
+# credentials in a git-committed values.yaml is not acceptable. They're read
+# from a Secret you create by hand once (see README.md), never committed.
+secret:
+  name: actual-budget-exporter-secrets
+
+resources:
+  requests:
+    cpu: 50m
+    memory: 64Mi
+  limits:
+    memory: 128Mi
+
+serviceMonitor:
+  enabled: true
+  interval: 30s