#1560 feat: Add optional Prometheus Operator PodMonitor to Helm chart

What type of PR is this?

/kind feature

What this PR does / why we need it:

Adds optional Prometheus Operator PodMonitor resources to the Kelos Helm
chart so operators can wire up metrics scraping declaratively, without writing
manual Prometheus scrape config.

The chart already exposes Prometheus metrics on :8080 for the control-plane
pods, but shipped nothing to tell a Prometheus Operator to scrape them — the
values.yaml comments even pointed users at "a PodMonitor" they had to build
themselves. This PR closes that gap. It is fully additive and disabled by
default, so clusters without the Prometheus Operator CRDs are unaffected.

• values.yaml: new documented podMonitor block:
  • podMonitor.enabled (default false) — scrape the control-plane pods
    (controller manager, webhook servers, slack server) in the release
    namespace.
  • interval, scrapeTimeout, honorLabels, labels, annotations.
  • podMonitor.spawners.enabled (default false) — additionally scrape the
    dynamically-created spawner pods.
• templates/podmonitor.yaml (new): two conditionally-rendered
  monitoring.coreos.com/v1 PodMonitor documents:
  • kelos-controlplane — selects app.kubernetes.io/name: kelos and scrapes
    the named metrics port (8080). This uniformly covers the controller
    manager, all webhook sources, and the slack server, and skips the session
    server (whose :8080 serves the web app, not metrics).
  • kelos-spawners — selects kelos.dev/component: spawner with
    namespaceSelector.any: true, since spawner pods run in arbitrary
    namespaces.
• docs/reference.md: new "Scraping with Prometheus Operator" subsection
  under "Prometheus Metrics" documenting the podMonitor values.
• internal/helmchart/render_test.go: render tests for disabled-by-default,
  enabled (selector/port/interval overrides), spawners-enabled (both monitors +
  cross-namespace selector), spawners-require-parent-enabled, and
  labels/annotations propagation.

No new dependency and no Go controller/API changes.

Which issue(s) this PR is related to:

Fixes #1213

Special notes for your reviewer:

• PodMonitor instead of the ServiceMonitor named in the issue. The issue's
  proposed template assumes a single metrics Service and kelos.fullname /
  kelos.labels helpers. In reality the controller manager and slack server
  expose metrics on the pod only — there is no metrics Service to select —
  and the chart has no _helpers.tpl (labels are hard-coded
  app.kubernetes.io/name: kelos + component). A ServiceMonitor would
  therefore have to add new Services for the controller and slack server, or
  silently cover only the webhook sources. A PodMonitor selecting the shared
  pod label gives uniform coverage with no new Services, and matches both the
  existing values.yaml guidance ("scrape metrics via a PodMonitor") and the
  in-tree GKE PodMonitoring precedent from #821.
• Control-plane vs spawner pods are disjoint populations. Control-plane pods
  use app.kubernetes.io/name: kelos in the release namespace; spawner pods use
  the kelos.dev/* label scheme in arbitrary namespaces. One selector cannot
  match both, so they are two separate PodMonitors. The spawner one is behind
  its own sub-toggle (default off) because cross-namespace scraping requires the
  Prometheus instance to be configured to select PodMonitors cluster-wide.
• Session server is intentionally excluded — its :8080 port is the web app
  (http), not a Prometheus metrics endpoint.
• Ran make verify and make test — both pass.

Does this PR introduce a user-facing change?

The Helm chart can now ship optional Prometheus Operator PodMonitor resources for scraping Kelos metrics, via a new `podMonitor` values block (disabled by default). `podMonitor.enabled` scrapes the control-plane pods (controller, webhook servers, slack server) and `podMonitor.spawners.enabled` additionally scrapes spawner pods.

---

Summary by cubic

Adds optional Prometheus Operator PodMonitor resources to the Kelos Helm chart to scrape control‑plane metrics on port 8080, plus an opt‑in monitor for spawner pods. Disabled by default so clusters without the CRDs are unaffected. Fixes #1213.

• New Features
  • Control‑plane PodMonitor selects app.kubernetes.io/name=kelos, scrapes the metrics port (8080), excludes session-server, and discovers pods in kelos-system and the release namespace.
  • Optional spawner PodMonitor behind podMonitor.spawners.enabled (requires podMonitor.enabled); selects kelos.dev/component=spawner across namespaces (namespaceSelector.any: true) and targets long‑lived spawners.
  • New values.yaml podMonitor block: enabled, interval, scrapeTimeout, honorLabels, labels, annotations; docs call out namespace discovery and RBAC; render tests cover defaults, overrides, spawner gating, and label/annotation propagation.