monitoring: track arbret.com expiry too

Domains are now a list in group_vars/all (monitored_domains) rather than the
single root_domain hardcoded in the playbook, so adding one is a line of data
instead of a change to the task.

arbret.com resolves to prd-arbret (167.99.242.62) and its RDAP record exposes
an expiry of 2027-02-18, so the check reads real data rather than silently
passing on a missing field - verified against rdap.verisign.com before wiring
it up.

Both domains checked daily with two weeks of runway, because registration
renewal is a manual act at the registrar and losing a domain is not recoverable
the way losing a host is.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

ansible/group_vars/all/main.yml

@@ -58,3 +58,17 @@ subdomains:
 # group covers them, so these are global rather than group_vars/<group>.
 ntfy_topic: alerts
 headscale_namespace: counter-net
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Domains whose registration expiry is monitored (infra/402_public_monitoring).
+#
+# Registration renewal is a manual act at the registrar, and losing a domain is
+# not recoverable in the way losing a host is - so these are checked daily and
+# alarm with two weeks of runway.
+#
+# root_domain is the estate's own domain; the rest are domains we own that are
+# served from it or from a host in the inventory.
+# ─────────────────────────────────────────────────────────────────────────────
+monitored_domains:
+  - "{{ root_domain }}"
+  - arbret.com