docs(ha-k8s): document ServiceMonitor scheme and tlsConfig for direct scraping

Covers memgraph/helm-charts#286, which adds prometheus.serviceMonitor.scheme
and prometheus.serviceMonitor.tlsConfig so Prometheus can scrape Memgraph's
OpenMetrics endpoint over HTTPS when Bolt TLS is enabled.

Author: as51340

pages/clustering/high-availability/setup-ha-cluster-k8s.mdx

@@ -1502,6 +1502,47 @@ exposes their monitoring ports automatically. The metric names differ from the l
 JSON exporter, so use the bundled **Memgraph OpenMetrics** dashboard.
 </Callout>
 
+#### ServiceMonitor TLS for direct scraping
+
+When an instance has `tls.bolt.enabled: true`, Memgraph serves its HTTP monitoring
+endpoint over HTTPS as well, so Prometheus must scrape it with `https`. Set
+`prometheus.serviceMonitor.scheme` and, if needed, a Prometheus Operator
+[`TLSConfig`](https://prometheus-operator.dev/docs/api-reference/api/#monitoring.coreos.com/v1.TLSConfig)
+through `prometheus.serviceMonitor.tlsConfig`:
+
+```yaml
+scrapeMemgraphDirectly: true
+
+prometheus:
+  enabled: false
+  serviceMonitor:
+    enabled: true
+    scheme: https
+    tlsConfig:
+      insecureSkipVerify: true
+```
+
+The `scheme` applies to every instance selected by the `ServiceMonitor`, so all
+coordinators and data instances must expose their metrics endpoint using the same
+protocol. `insecureSkipVerify: true` is convenient for self-signed certificates but
+not suitable for production; prefer `caFile`/`ca` together with `serverName` instead:
+
+```yaml
+prometheus:
+  serviceMonitor:
+    enabled: true
+    scheme: https
+    tlsConfig:
+      ca:
+        secret:
+          name: bolt-ca-bundle
+          key: ca.crt
+      serverName: memgraph.example.com
+```
+
+`tlsConfig` is rendered verbatim into the `ServiceMonitor` endpoint, so any field
+supported by your Prometheus Operator version can be used.
+
 #### Grafana dashboard for direct scraping
 
 Set `prometheus.grafanaDashboard.enabled: true` to ship the bundled "Memgraph
@@ -1861,6 +1902,8 @@ and their default values.
 | `prometheus.serviceMonitor.enabled`                        | If enabled, a `ServiceMonitor` object will be deployed.                                                      | `false`                        |
 | `prometheus.serviceMonitor.kubePrometheusStackReleaseName` | The release name under which `kube-prometheus-stack` chart is installed.                                     | `kube-prometheus-stack`        |
 | `prometheus.serviceMonitor.interval`                       | How often will Prometheus pull data from Memgraph's Prometheus exporter.                                     | `15s`                          |
+| `prometheus.serviceMonitor.scheme`                         | Protocol Prometheus uses when scraping Memgraph directly (`http` or `https`). Applies to every instance selected by the `ServiceMonitor`. | `http`        |
+| `prometheus.serviceMonitor.tlsConfig`                      | Prometheus Operator `TLSConfig` for direct HTTPS scraping (e.g. `insecureSkipVerify: true`, or `ca`/`serverName` for production).        | `{}`          |
 | `prometheus.grafanaDashboard.enabled`                      | Ship the bundled "Memgraph OpenMetrics" Grafana dashboard as a `ConfigMap` for a Grafana sidecar to auto-load. | `false`                      |
 | `prometheus.grafanaDashboard.namespace`                    | Namespace for the dashboard `ConfigMap`; must be one the Grafana sidecar watches. Defaults to `prometheus.namespace`, else release namespace. | `""`           |
 | `prometheus.grafanaDashboard.label`                        | Label the Grafana sidecar selects dashboards by.                                                             | `grafana_dashboard`            |