infra(gitlab): enable Prometheus, SSH proxy, explicit always-on type

- Enable Prometheus server (GitLab chart bundled) on gitlab node pool
- Add socat SSH proxy sidecar (port 2222 → gitlab-shell) to Tailscale proxy
- Remove nginx stream module (not available in alpine) in favor of socat
- Set unlimited nginx client_max_body_size for large git pushes
- Add workhorse extraArgs for API limits
- Explicit always_on_type = DEV1-M in kapsule terragrunt

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

infra/k8s/gitlab/tailscale-proxy.yaml

@@ -74,6 +74,20 @@ spec:
             limits:
               cpu: 100m
               memory: 64Mi
+        - name: ssh-proxy
+          image: alpine/socat:latest
+          args:
+            - "TCP-LISTEN:2222,fork,reuseaddr"
+            - "TCP:gitlab-gitlab-shell.foxhunt.svc.cluster.local:2222"
+          ports:
+            - containerPort: 2222
+          resources:
+            requests:
+              cpu: 10m
+              memory: 16Mi
+            limits:
+              cpu: 50m
+              memory: 32Mi
         - name: tailscale
           image: ghcr.io/tailscale/tailscale:latest
           env:
@@ -120,7 +134,7 @@ data:
         listen 80;
         server_name git.fxhnt.ai;
 
-        client_max_body_size 250m;
+        client_max_body_size 0;
 
         location / {
             proxy_pass http://gitlab-webservice-default.foxhunt.svc.cluster.local:8181;

infra/k8s/gitlab/values.yaml

@@ -67,7 +67,28 @@ certmanager:
 nginx-ingress:
   enabled: false
 prometheus:
-  install: false
+  install: true
+  rbac:
+    create: true
+  alertmanager:
+    enabled: false
+  server:
+    nodeSelector:
+      k8s.scaleway.com/pool-name: gitlab
+    tolerations:
+      - key: gitlab
+        operator: Equal
+        value: "true"
+        effect: NoSchedule
+    persistentVolume:
+      enabled: false
+    resources:
+      requests:
+        cpu: 100m
+        memory: 256Mi
+      limits:
+        cpu: 500m
+        memory: 512Mi
 gitlab-runner:
   install: false
 
@@ -96,6 +117,8 @@ gitlab:
       minReplicas: 1
       maxReplicas: 1
     workerProcesses: 2
+    workhorse:
+      extraArgs: "-apiLimit 0 -apiQueueLimit 0"
     nodeSelector:
       k8s.scaleway.com/pool-name: gitlab
     tolerations:

infra/live/production/kapsule/terragrunt.hcl

@@ -9,6 +9,7 @@ terraform {
 inputs = {
   cluster_name   = "foxhunt"
   k8s_version    = "1.34"
+  always_on_type = "DEV1-M"
 
   # GPU training pool (H100 for 10-model ensemble training)
   enable_gpu_training_pool = true