[monitoring] TTFB monitoring via Prometheus Operator Probes (port of deployment#70)

[henzigo]

Context

Upstream PR shopsys/deployment#70 adds TTFB monitoring for production: it generates
Prometheus Operator Probe resources (scraped via blackbox-exporter) for a configurable set
of URL paths on one domain, including HTTP basic auth handling and slug/path normalization.
That PR targets the legacy bash package — this issue ports the feature into the chart, where
it becomes a simple values-driven template.

Proposal

monitoring:
  ttfbProbes:
    enabled: false
    domainIndex: 0            # which of `domains` to probe (legacy TTFB_PROBES_DOMAIN)
    paths:                    # legacy TTFB_PROBES map; key = probe type (alphanumeric slug)
      homepage: /
      product: /some-product
    # blackbox module/labels configurable as needed

• template renders one monitoring.coreos.com/v1 Probe per entry, named ttfb-<slug>,
  labeled with project/type (mirror the labels from the upstream PR template)
• HTTP basic auth: when the target domain has auth enabled (same helper as the ingresses),
  embed credentials — but source them from a Secret reference rather than plaintext in the CR
  if blackbox-exporter setup allows (improvement over the upstream PR)
• "production only" is expressed naturally by enabling the block only in the production
  environment values — no special casing in the chart
• gate CRD availability: render only when monitoring.ttfbProbes.enabled (and document the
  Prometheus Operator prerequisite); consider .Capabilities.APIVersions.Has guard
• kubeconform: needs the Probe CRD schema (add -schema-location for CRDs or skip that kind)

Tasks

• probe-ttfb.yaml template + values + schema
• Auth handling (secret-based if feasible, else parity with the upstream PR)
• Unit tests (slug validation, path normalization, auth on/off), golden update
• Docs (values.md + prerequisite note)

Reference: shopsys/deployment#70