fix(monitoring): render alertmanager.yml from template at deploy (fixes crash loop)

Alertmanager does not expand ${ENV} in its YAML, so the committed config with
${TELEGRAM_BOT_TOKEN}/${TELEGRAM_CHAT_ID} crash-looped it (line 24: cannot
unmarshal !!str `${TELEG...` into int64) - 11k+ restarts on prod, alerting dead.

- rename alertmanager.yml -> alertmanager.yml.template (keeps ${} placeholders)
- deploy.sh: envsubst the template into the (gitignored) alertmanager.yml from
  .env, scoped to the two TELEGRAM vars so the {{ }} Go-template message survives
- gitignore the rendered file (contains the bot token)
- warns if the vars are unset

.gitignore

@@ -28,3 +28,6 @@ site/dist/
 site/.astro/
 mcp/dist/
 data/hc_warmup*.csv
+
+# Rendered from monitoring/alertmanager.yml.template by deploy.sh (contains secrets)
+monitoring/alertmanager.yml