feat: add PrometheusRule alerts for all services

28 alert rules across 9 PrometheusRule files covering infrastructure
(Longhorn, cert-manager), data (PostgreSQL, OpenBao, OpenSearch),
storage (SeaweedFS), devtools (Gitea), identity (Hydra, Kratos),
media (LiveKit), and mesh (Linkerd golden signals for all services).

Severity routing: critical alerts fire to Matrix + email, warnings
to Matrix only (AlertManager config updated in separate commit).

base/ory/kustomization.yaml

@@ -13,6 +13,9 @@ resources:
   # Hydra chart CRDs are not rendered by helm template; apply manually.
   - hydra-oauth2client-crd.yaml
   - vault-secrets.yaml
+  - ory-alertrules.yaml
+  - hydra-servicemonitor.yaml
+  - kratos-servicemonitor.yaml
 
 patches:
   # Set Kratos selfservice UI URLs (DOMAIN_SUFFIX substituted at apply time).