fix(chart): raise WAF floor to 5 req/s and scope to release namespace

graph-italia ingress traffic peaks at ~0.05 req/s, so the previous >1
req/s floor already silenced the alert; raise it to >5 req/s so it only
fires on genuinely high sustained traffic with a 4xx storm.

Also scope the query to this release's own ingresses via
exported_namespace (the nginx 'namespace' label is the controller's ns,
not the ingress's; the old .*graph-italia.* regex also matched the test
ingresses). Now prod monitors prod, test monitors test.

Author: r4770

charts/graph-italia/templates/prometheusrule.yaml

@@ -125,25 +125,27 @@ spec:
         # -----------------------------------------------------------------------
         # Guarded by a minimum-traffic floor: at low volume a handful of scanner
         # 4xx (e.g. 404s) easily exceeds the 30% ratio and trips a false
-        # positive. Requiring >1 req/s of total ingress traffic means this only
-        # fires on a genuine high-volume 4xx storm. severity=warning so it is
-        # not treated as a critical incident (was a noisy critical false
-        # positive — see k8s-configuration/RIGHTSIZING.md).
+        # positive. Requiring >5 req/s of total ingress traffic means this only
+        # fires on a genuine high-volume 4xx storm. Scoped to this release's own
+        # namespace via exported_namespace (the nginx `namespace` label is the
+        # controller's ns, not the ingress's). severity=warning so it is not
+        # treated as a critical incident (was a noisy critical false positive —
+        # see k8s-configuration/RIGHTSIZING.md).
         - alert: GraphItaliaHighWAFBlocks
           expr: |
             (
-              sum(rate(nginx_ingress_controller_requests{status=~"4..", ingress=~".*graph-italia.*"}[10m]))
+              sum(rate(nginx_ingress_controller_requests{status=~"4..", exported_namespace="{{ .Release.Namespace }}"}[10m]))
               /
-              sum(rate(nginx_ingress_controller_requests{ingress=~".*graph-italia.*"}[10m]))
+              sum(rate(nginx_ingress_controller_requests{exported_namespace="{{ .Release.Namespace }}"}[10m]))
             ) > 0.30
             and
-            sum(rate(nginx_ingress_controller_requests{ingress=~".*graph-italia.*"}[10m])) > 1
+            sum(rate(nginx_ingress_controller_requests{exported_namespace="{{ .Release.Namespace }}"}[10m])) > 5
           for: 10m
           labels:
             severity: warning
             service: graph-italia
             namespace: {{ .Release.Namespace }}
           annotations:
             summary: "High 4xx rate on Graph Italia ingress - possible attack or WAF issue"
-            description: "{{ "{{ $value | humanizePercentage }}" }} of requests are returning 4xx (>30%) at >1 req/s for 10+ minutes"
+            description: "{{ "{{ $value | humanizePercentage }}" }} of requests are returning 4xx (>30%) at >5 req/s for 10+ minutes"
 {{- end }}