Operators can't see or alert on NAT egress health #722

Summary

The egress shards count every drop by reason and track their session table, but the monitoring bundle ships scrape configs and alert rules for the two routers only, not for NAT.

A shard that stops translating, fills its session table, or starts dropping replies is invisible until a tenant reports broken egress. The #684 design calls these SLIs out as missing before implementation.

Acceptance criteria

• Deploying the monitoring bundle collects NAT drop counters and session table use from every shard
• An operator is alerted when a shard stops translating or its drop rate climbs well past its baseline
• An operator is alerted before a shard's session table fills