feat: add PrometheusRule alerts for all services

28 alert rules across 9 PrometheusRule files covering infrastructure
(Longhorn, cert-manager), data (PostgreSQL, OpenBao, OpenSearch),
storage (SeaweedFS), devtools (Gitea), identity (Hydra, Kratos),
media (LiveKit), and mesh (Linkerd golden signals for all services).

Severity routing: critical alerts fire to Matrix + email, warnings
to Matrix only (AlertManager config updated in separate commit).

base/data/kustomization.yaml

@@ -11,9 +11,9 @@ resources:
   - opensearch-deployment.yaml
   - opensearch-service.yaml
   - opensearch-pvc.yaml
-  - openbao-keys-placeholder.yaml
   - barman-vault-secret.yaml
-  - opensearch-servicemonitor.yaml
+  # opensearch-servicemonitor.yaml removed — OpenSearch 3.x has no prometheus-exporter plugin.
+  # TODO: add opensearch-exporter sidecar for Prometheus metrics.
   - opensearch-alertrules.yaml
   - postgres-alertrules.yaml
   - openbao-alertrules.yaml