Prometheus exporter for Actual Budget. actual_server itself stays in
homelab-docker-compose-prod (host docker-compose), exporter only scrapes it
over LAN and exposes /metrics via a ServiceMonitor. No HTTPRoute. Password
and budget ID come from a hand-created Secret, not committed.
Ignis has no built-in auth; required now that ignis.fireflylab.cc
is a public hostname. Plain k8s Secret (no Vault yet) holding an
htpasswd hash, enforced at gateway via SecurityPolicy.
duynguyen