[uptime-kuma] Fix duplicate monitor creation + clean up down monitors

## Duplicate bug fix
The external-monitor-sync deduped targets by hostname (`host in seen`) but
multiple ingresses can share the same hostname. Changed to dedupe by final
monitor name (`f"{PREFIX}{label}" in seen`) — prevents creating duplicate
[External] monitors on every sync run. This caused 90 duplicates.

## Monitor cleanup
Deleted 118 monitors total:
- 90 duplicate [External] monitors (kept lower ID of each pair)
- 14 paused internal monitors for decommissioned services
- 14 external monitors for non-existent, scaled-down, or non-HTTP services
  (xray-vless, complaints, hermes-agent, etc.)

## Opt-outs
Added `uptime.viktorbarzin.me/external-monitor=false` annotation to ingresses
that shouldn't have external HTTP monitors: xray (non-HTTP protocol),
council-complaints, hermes-agent, task-webhook, torrserver, www (no CF DNS).

329 monitors → ~210 monitors. Zero down monitors expected.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

stacks/uptime-kuma/modules/uptime-kuma/main.tf

@@ -373,10 +373,11 @@ def load_from_api():
                 host = rules[0].get("host")
         if not host or not host.endswith(".viktorbarzin.me"):
             continue  # skip internal-only or non-public hosts
-        if host in seen:
-            continue
-        seen.add(host)
         label = anns.get(ANNOTATION_NAME) or host.split(".")[0]
+        monitor_name = f"{PREFIX}{label}"
+        if monitor_name in seen:
+            continue  # dedupe by final monitor name, not hostname (fixes duplicate creation)
+        seen.add(monitor_name)
         targets.append({"name": label, "url": f"https://{host}"})
     return targets