chrome-service + mam-farming: doc clarifications (+ re-trigger CI apply missed earlier)

Two small doc additions that also re-include these stacks in Woodpecker's
changed-stack detection. The earlier 2-commit push left chrome-service out of the
HEAD~1..HEAD diff so its ignore_changes fix never applied; the monitoring apply was
separately blocked by a stuck prometheus pending-upgrade (now cleared).

- chrome-service: note the live pod's container order had drifted from this file's
  order, so a TF apply reorders them (containers[0] differs live-vs-TF until the
  apply lands) -- documents the confusion this caused during diagnosis.
- mam-farming: cross-ref the grabber script that emits mam_grabber_last_run_timestamp.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

stacks/chrome-service/main.tf

@@ -445,6 +445,10 @@ resource "kubernetes_deployment" "chrome_service" {
       # clobber to the novnc image stick (chromium-not-found crashloop 2026-06-16)
       # because TF could not revert the ignored field. Removed so TF re-asserts the
       # pinned image. Keel is inert (keel.sh/policy=never) and no deploy step touches these.
+      # NOTE: the LIVE pod's container order had drifted to [novnc, chrome-service,
+      # snapshot] vs this file's [chrome-service, novnc, snapshot]; a TF apply reorders
+      # them to match here (harmless), so `containers[0]` differs between live and TF
+      # until the next apply lands — don't be alarmed reading it back mid-reconcile.
       spec[0].template[0].spec[0].init_container[0].image,
       metadata[0].annotations["kubernetes.io/change-cause"],
       metadata[0].annotations["deployment.kubernetes.io/revision"],

stacks/monitoring/modules/monitoring/prometheus_chart_values.tpl

@@ -2840,6 +2840,7 @@ serverFiles:
             annotations:
               summary: "MAM ratio is {{ $value | printf \"%.2f\" }} for 24h (target: >= 1.0)"
           - alert: MAMFarmingStuck
+            # Metric source: stacks/servarr/mam-farming/files/freeleech-grabber.py
             # Heartbeat-based: fires only when the grabber CronJob has not COMPLETED
             # a run in >4h (the original failure mode: Forbid-blocked / wedged in
             # ContainerCreating). The grabber heartbeats mam_grabber_last_run_timestamp