Publish sanitized P2Pool hashrate stats

Enable P2Pool's --data-api/--local-api and add a small stdlib-only sidecar
that copies an allowlist of numeric fields (node/sidechain hashrate,
connected miners, shares, network difficulty) to /p2pool/stats.json. Worker
IPs and wallet fragments in local/stratum are never served.

An Ingress adds that single path to the website host (www.eom.dev by
default), so the homepage can read it same-origin and reuse its TLS cert.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018STDcc5BaYxPMNA9S8Wycs

defaults/main.yml

@@ -14,6 +14,15 @@ monero_p2pool_addpeers: []
 
 monerod_rpc_secret_name: monerod-rpc
 
+# Public P2Pool stats: node and sidechain hashrate, connected miner count,
+# shares and network difficulty, served at https://<host>/p2pool/stats.json.
+# Worker IPs and wallet fragments are never included. The path is added to
+# an existing website host so it shares that host's TLS certificate; set the
+# host to "" to keep the stats cluster-internal (service p2pool-stats:8080).
+monero_p2pool_stats_host: www.eom.dev
+monero_p2pool_stats_ingress_class: nginx
+monero_p2pool_stats_image: python:3.13-alpine
+
 # Required (Vault).
 monerod_user: ""
 monerod_password: ""