Let a TerdutServer turn on metrics from the alerts' Prometheus

terdut-server v0.49.0 graphs the metric behind each alert on the incident
page, but only queries hosts listed in TERDUT_PROMETHEUS_ALLOWED_HOSTS,
because the URL comes out of a webhook payload. An install this operator
creates had no way to set it short of spec.pod.extraEnv.

spec.prometheus takes allowedHosts, preroll and timeout and maps them to
TERDUT_PROMETHEUS_ALLOWED_HOSTS, _PREROLL and _TIMEOUT. Nothing is emitted
unless allowedHosts is non-empty, so existing TerdutServers get the same
Deployment as before, and unset durations are left to the server's defaults.
There is no CRD default for the host: which Prometheus to trust is the
deployer's call, not something this operator should assume.

The CRD in config/ is regenerated and the chart's copy carries the same
schema; the chart's optional TerdutServer passes the block through.

Claude-Session: https://claude.ai/code/session_016mBLURvJoMuUEr9cB2RpUN

config/crd/bases/terdut.ryuvia.com_terdutservers.yaml

@@ -4298,6 +4298,34 @@ spec:
                       type: object
                     type: array
                 type: object
+              prometheus:
+                description: |-
+                  prometheus enables the metrics on an incident (terdut-server
+                  v0.49.0+; an older image ignores the env vars it produces).
+                properties:
+                  allowedHosts:
+                    description: |-
+                      allowedHosts are the Prometheus servers terdut-server may query,
+                      passed as TERDUT_PROMETHEUS_ALLOWED_HOSTS. Entries are host names
+                      (with "*" as one DNS label and a leading "**" as one or more), IPs or
+                      CIDR ranges, each with an optional ":port", e.g.
+                      "kube-prometheus-stack-prometheus.kube-prometheus-stack:9090" or
+                      "*.monitoring.svc". Empty turns the feature off. The server refuses to
+                      start on a malformed entry or a bare "*".
+                    items:
+                      type: string
+                    type: array
+                  preroll:
+                    description: |-
+                      preroll is how far before an alert started its graph begins (a Go
+                      duration, e.g. "1h"). Unset uses terdut-server's default.
+                    type: string
+                  timeout:
+                    description: |-
+                      timeout bounds one request to a Prometheus (a Go duration, e.g.
+                      "10s"). Unset uses terdut-server's default.
+                    type: string
+                type: object
               replicas:
                 default: 2
                 description: |-