fix(netpol): allow Prometheus scrape of gateway /metrics

Selector used a plain `name: monitoring` label, but only ingress-nginx
carries that label in this cluster — every other namespace has just
kubernetes.io/metadata.name. The rule matched nothing, so the new
api-gateway ServiceMonitor discovered all 3 replicas but every scrape
died with context deadline exceeded.

Switch to kubernetes.io/metadata.name: monitoring.

k8s/network-policy.yaml

@@ -21,11 +21,17 @@ spec:
     ports:
     - protocol: TCP
       port: 8080
-  # Allow from Prometheus scraping (if in monitoring namespace)
+  # Allow from Prometheus scraping (monitoring namespace)
+  # MUST select on kubernetes.io/metadata.name, not a plain `name:` label.
+  # Only ingress-nginx carries a plain `name` label in this cluster; every
+  # other namespace has just kubernetes.io/metadata.name, so `name: monitoring`
+  # matched nothing and silently denied every Prometheus scrape of :8080
+  # (surfaced as context-deadline-exceeded on all 3 gateway replicas while the
+  # ServiceMonitor itself was discovered and healthy).
   - from:
     - namespaceSelector:
         matchLabels:
-          name: monitoring
+          kubernetes.io/metadata.name: monitoring
     ports:
     - protocol: TCP
       port: 8080