feat: add PrometheusRule alerts for all services

28 alert rules across 9 PrometheusRule files covering infrastructure
(Longhorn, cert-manager), data (PostgreSQL, OpenBao, OpenSearch),
storage (SeaweedFS), devtools (Gitea), identity (Hydra, Kratos),
media (LiveKit), and mesh (Linkerd golden signals for all services).

Severity routing: critical alerts fire to Matrix + email, warnings
to Matrix only (AlertManager config updated in separate commit).

base/mesh/kustomization.yaml

@@ -3,6 +3,7 @@ kind: Kustomization
 
 resources:
   - namespace.yaml
+  - linkerd-alertrules.yaml
 
 # NOTE: Linkerd stable releases moved behind a commercial paywall in Feb 2024.
 # As of 2.15, stable artifacts are Buoyant Enterprise for Linkerd (BEL) only.