feat(monitoring): wire up full LGTM observability stack

- Prometheus: discover ServiceMonitors/PodMonitors in all namespaces,
  enable remote write receiver for Tempo metrics generator
- Tempo: enable metrics generator (service-graphs + span-metrics)
  with remote write to Prometheus
- Loki: add Grafana Alloy DaemonSet to ship container logs
- Grafana: enable dashboard sidecar, add Pingora/Loki/Tempo/OpenBao
  dashboards, add stable UIDs and cross-linking between datasources
  (Loki↔Tempo derived fields, traces→logs, traces→metrics, service map)
- Linkerd: enable proxy tracing to Alloy OTLP collector, point
  linkerd-viz at existing Prometheus instead of deploying its own
- Pingora: add OTLP rollout plan (endpoint commented out until proxy
  telemetry panic fix is deployed and Alloy is verified healthy)

base/monitoring/kustomization.yaml

@@ -7,6 +7,7 @@ resources:
   - namespace.yaml
   - vault-secrets.yaml
   - grafana-oauth2client.yaml
+  - dashboards-configmap.yaml
 
 helmCharts:
   # helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
@@ -32,3 +33,12 @@ helmCharts:
     releaseName: tempo
     namespace: monitoring
     valuesFile: tempo-values.yaml
+
+  # Grafana Alloy — DaemonSet that ships container logs → Loki
+  # and provides an in-cluster OTLP receiver → Tempo.
+  - name: alloy
+    repo: https://grafana.github.io/helm-charts
+    version: "0.12.0"
+    releaseName: alloy
+    namespace: monitoring
+    valuesFile: alloy-values.yaml