infra: add monitoring-service network policy, allow web-gateway egress

monitoring-service needs egress to Prometheus (port 80/9090) and ingress
from web-gateway (port 50057). web-gateway needs egress to monitoring-service.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

infra/k8s/network-policies/monitoring-service.yaml

@@ -0,0 +1,37 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: monitoring-service
+  namespace: foxhunt
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: monitoring-service
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    # gRPC from web-gateway
+    - from:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: web-gateway
+      ports:
+        - protocol: TCP
+          port: 50057
+  egress:
+    # Prometheus HTTP API (port 80)
+    - to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: prometheus
+      ports:
+        - protocol: TCP
+          port: 80
+    - to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: prometheus
+      ports:
+        - protocol: TCP
+          port: 9090

infra/k8s/network-policies/web-gateway.yaml

@@ -59,6 +59,14 @@ spec:
       ports:
         - protocol: TCP
           port: 50056
+    # Monitoring service gRPC
+    - to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: monitoring-service
+      ports:
+        - protocol: TCP
+          port: 50057
     # Minio (initContainer binary fetch)
     - to:
         - podSelector: