monitoring: fix false HttpEndpointDown alert for self-signed FE cert

- blackbox.yml: add http_2xx_insecure module (TLS skip) for FE probing
- prometheus.yml: split blackbox_http (internal HTTP) vs blackbox_https_external
  (external HTTPS targets using insecure module); remove notify.f0xx.org probe
  until FE nginx proxies it
- service_alerts.yml: HttpEndpointDown/SlowResponse cover both jobs via regex
- TODO: replace http_2xx_insecure with strict module once FE gets LE cert

Co-authored-by: Cursor <cursoragent@cursor.com>

monitoring/cast04/rules/service_alerts.yml

@@ -8,7 +8,7 @@ groups:
 
       # ── HTTP endpoint down ───────────────────────────────────────────────────
       - alert: HttpEndpointDown
-        expr: probe_success{job="blackbox_http"} == 0
+        expr: probe_success{job=~"blackbox_http|blackbox_https_external"} == 0
         for: 3m
         labels:
           severity: critical
@@ -17,7 +17,7 @@ groups:
           description: "blackbox probe to {{ $labels.instance }} is failing for >3 min."
 
       - alert: HttpSlowResponse
-        expr: probe_duration_seconds{job="blackbox_http"} > 5
+        expr: probe_duration_seconds{job=~"blackbox_http|blackbox_https_external"} > 5
         for: 5m
         labels:
           severity: warning