docs(todo): note PodMonitor + DASHBOARD applied to live; node-label partial closure

Adds a 2026-05-02 Done entry covering the cluster-side work that paired
with c3fae73 (source) and 03bb731 (chart cleanups): PodMonitor migration
applied with verified zero-data-loss handoff; supabase chart upgraded
revision 1→3; helm field-manager conflict on Kong configmap resolved;
node label drift on knoe-dev-0 closed (3 nodes labelled
knoe.dev/node-role=general alongside legacy prole.org/node-role); DB
cluster nodes still pending same treatment.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs/TODO.md

@@ -95,6 +95,8 @@ Items where docs describe an intended state that doesn't match live state. Each
 
 *(items get archived here when they land, with a date and commit reference; or just delete if not worth memorializing)*
 
+- 2026-05-02 — **Apply Junie's PodMonitor migration + DASHBOARD removal to live** (queue #13 + #15 follow-up; commit [03bb731](#) for chart fixes). Source landed in c3fae73; this is the corresponding live-cluster apply on `knoe-dev-cnpg-0` + `knoe-dev-0`. Sequence: applied updated `knoe-db.yaml` → CNPG GC'd its auto-managed PodMonitor (deleted on poll attempt 1, ~2s) → applied manual `knoe-db-podmonitor.yaml` (now ownerRef=`<none>`, survives future cluster spec changes) → verified Prometheus still scraping all 3 postgres exporters (`health=up` on 10.24.{0,1,2}.x:9187) and `cnpg_pg_stat_archiver_archived_count{cluster="knoe-db"}` returns data confirming cluster-label relabel still works. Then `helm upgrade supabase ./supabase/helm/knoe-supabase --reset-then-reuse-values` (revision 1 → 3 after a partial-failure retry); configmap field-manager dual-ownership conflict resolved by deleting + recreating fresh under helm. Two chart cleanups required as follow-ups (committed as 03bb731): deleted `templates/test/kong.yaml` (helm-test job for the now-dead dashboard basic-auth gate) and added `secret.oauth2proxy` defaults in values.yaml so the vestigial `templates/studio/oauth2proxy-*.yaml` chart resources (Junie Phase-2 OIDC artifacts; the deployed oauth2-proxy lives outside this chart at `deploy/gcp/gke/oauth2-proxy-deployment.yaml` and goes in FRONT of supabase-kong, not behind it) can evaluate guards cleanly. Side-finding closed live: all 3 knoe-dev-0 nodes had the legacy `prole.org/node-role=general` label only; Junie's chart defaults to `nodeAffinity: knoe.dev/node-role=general`, which made the new kong pod stuck in Pending. Labelled all 3 nodes with `knoe.dev/node-role=general` (additive — kept the prole.org label too for any other manifests still referencing it). DB cluster still on legacy-label-only; reapply when relevant. External smoke tests post-upgrade: `/onboard.html`→200, `/rest/v1/` no-auth→401, `/`→302, `/healthz`→302, `svc.knoe.dev/grafana/login`→200.
+
 - 2026-05-02 — **Wire `cnpg-backup-sa` into CNPG cluster spec + init script** (queue #7 / drift R8). `deploy/gcp/gke/knoe-db.yaml` gains `spec.serviceAccountName: cnpg-backup-sa` (requires CNPG v1.29+). `etc/init_cnpg_gke.sh`: operator install URL now uses `CNPG_OPERATOR_VERSION` variable (default `1.29.0`); new §11 patches both `knoe-db` and `knoe-db-barman-cloud` RoleBindings to add `cnpg-backup-sa` as a subject if not already present, matching the 2026-04-29 live stabilization. `bash -n` clean. Brief: [`docs/plans/junie/07-init-cnpg-gke-sa-wiring.md`](plans/junie/07-init-cnpg-gke-sa-wiring.md).
 
 - 2026-05-02 — **Migrate off CNPG-deprecated `enablePodMonitor` + `podMonitorRelabelings`** (queue #13). Both deprecated fields removed from `deploy/gcp/gke/knoe-db.yaml` `spec.monitoring`. New sibling manifest `deploy/gcp/gke/knoe-db-podmonitor.yaml` carries the `PodMonitor` with the `cluster` relabeling rule (sourced from `cnpg.io/cluster` pod label; required for all 85 CNPG Grafana dashboard panels). Apply alongside `knoe-db.yaml`. Brief: [`docs/plans/junie/13-podmonitor-manual-management.md`](plans/junie/13-podmonitor-manual-management.md).