Address post-merge review feedback for hosted control plane metrics

- Switch authentication from bearer token + TokenReview to mTLS client
  certificate verification using the existing metrics-client-certs and
  cluster-signer-ca infrastructure
- Use honorLabels: true on PodMonitor endpoints instead of metricRelabelings
  to handle label conflicts between proxy-injected and target labels
- Fix imprecise source_pod references to use the standard pod label
- Update user story to reference AlertingRule CRs and user-defined monitoring
  instead of PrometheusRule

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: csrwng