Adopt OpenCost native hcloud provider for per-instance Hetzner pricing (blocked on opencost#3710)

[devantler]

🤖 Generated with Claude Code, at the maintainer's request.

Goal

Switch OpenCost from the current flat customPricing to the native hcloud provider for exact, per-instance, per-location Hetzner pricing pulled from the Hetzner Cloud API.

Why

Today opencost/helm-release.yaml uses a single CX33-derived customPricing (CPU 0.9441, RAM 0.4720 USD/month, 50/50 split). That's exact for the six CX33 control-plane/worker nodes, but a single per-CPU/per-GB rate can't capture Hetzner's economy-of-scale across instance types:

type	€/vCPU/mo
CX23	€2.00
CX33	€1.62
CX43	€1.50
CX53	€1.41

So autoscale nodes that aren't CX33 are priced a few % off. The native provider reads each node's hcloud://<id> providerID and looks up the real per-instance/per-location rate, eliminating the approximation.

Blocker (why this is a tracking issue, not a PR)

opencost#3710 (the hcloud provider) is still open — based on develop, not merged, and not present in the deployed OpenCost 1.120.3 (chart 2.5.x). Swapping provider/relying on hcloud:// auto-detection now would leave OpenCost with no matching provider and break the cost model. Adopt only once #3710 merges and ships in an OpenCost release.

Already in place

• Hetzner API token is seeded into OpenBao (vault-seed/seed-hcloud.yaml) and materialized as the hcloud Secret for CCM/CSI — so exposing it to the opencost namespace is a small ESO step.

Steps when #3710 ships in a release

1. Bump the opencost HelmRelease chart to the version whose appVersion includes the hcloud provider.
2. Add an ESO ExternalSecret materializing a read-only HCLOUD_TOKEN into the opencost namespace from the OpenBao path (don't reuse the CCM/CSI Secret cross-namespace).
3. Set opencost.exporter.env HCLOUD_TOKEN (fallback CLOUD_PROVIDER_API_KEY); the provider auto-detects from hcloud:// providerIDs.
4. Remove the customPricing block.
5. Re-derive the Coroot blended per-CPU/per-GB rate (the #1783 coroot-custom-cloud-pricing CronJob) from the new authoritative per-instance numbers so the two cost views stay consistent — Coroot's model is per-CPU/per-GB only and can't consume the provider directly.
6. Validate (kubectl kustomize prod+local, ksail --config ksail.prod.yaml workload validate) and open a draft PR.

Refs

• Coroot side of the same cost-accuracy fix: fix(coroot): price Hetzner nodes correctly instead of the ~16x GCP-C4 fallback #1783
• opencost#3710 (native hcloud provider), opencost#3523 (Hetzner cost tracking discussion)

[devantler]

🤖 Generated by the Daily AI Engineer

Added the blocked label. This issue names its external blocker (opencost#3710) in its own
title, but without the label it surfaced as the oldest actionable issue on every portfolio
survey, so each scheduled run re-read it to rediscover it was blocked.

No change to the substance — the adoption steps stand as written, gated on #3710 shipping in an
OpenCost release. The recurring survey cost is tracked as devantler-tech/monorepo#2243.