Let a TerdutServer turn on metrics from the alerts' Prometheus

terdut-server v0.49.0 graphs the metric behind each alert on the incident
page, but only queries hosts listed in TERDUT_PROMETHEUS_ALLOWED_HOSTS,
because the URL comes out of a webhook payload. An install this operator
creates had no way to set it short of spec.pod.extraEnv.

spec.prometheus takes allowedHosts, preroll and timeout and maps them to
TERDUT_PROMETHEUS_ALLOWED_HOSTS, _PREROLL and _TIMEOUT. Nothing is emitted
unless allowedHosts is non-empty, so existing TerdutServers get the same
Deployment as before, and unset durations are left to the server's defaults.
There is no CRD default for the host: which Prometheus to trust is the
deployer's call, not something this operator should assume.

The CRD in config/ is regenerated and the chart's copy carries the same
schema; the chart's optional TerdutServer passes the block through.

Claude-Session: https://claude.ai/code/session_016mBLURvJoMuUEr9cB2RpUN

DESIGN.md

@@ -107,6 +107,10 @@ spec:
     fallbackTopic: ""
     repeatEvery: 15m
     tokenSecretRef: {name: "", key: token}
+  prometheus:                      # terdut-server v0.49.0+: metrics on incidents; off unless allowedHosts is set
+    allowedHosts: []               # e.g. ["kube-prometheus-stack-prometheus.kube-prometheus-stack:9090"]; wildcards: "*.monitoring.svc"
+    preroll: ""                    # unset = server default (1h)
+    timeout: ""                    # unset = server default (10s)
   oidc:
     enabled: false
     issuer: ""