Scrape Prometheus Over the VPC, Not Through Cloudflare

We routed our Prometheus scrape through Cloudflare's edge with a WAF rule + OAuth gate. Both droplets shared a DO VPC. Here's the simpler architecture we should have built first.