T-0.1 Flux GitOps layout + dev/prod overlays + platform component skeletons (R-GITOPS-01/03, R-ENV-02, R-PLAT-01)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

platform/monitoring/kube-prometheus-stack.yaml

@@ -0,0 +1,44 @@
+---
+# kube-prometheus-stack — Prometheus + Alertmanager + Grafana (docs/10). Phase 0 STUB.
+# Retention/sizes are overlay knobs (R-ENV-02). Alertmanager emails via SMTP.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: kube-prometheus-stack
+  namespace: monitoring
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: kube-prometheus-stack
+      version: ">=65.0.0 <66.0.0"   # TODO(WS-OBS): pin at bring-up; Renovate maintains
+      sourceRef:
+        kind: HelmRepository
+        name: prometheus-community
+        namespace: monitoring
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    prometheus:
+      prometheusSpec:
+        retention: ${MONITORING_PROMETHEUS_RETENTION}     # overlay knob (dev short / prod long)
+        storageSpec:
+          volumeClaimTemplate:
+            spec:
+              storageClassName: longhorn                  # replicated tier (ADR-0003)
+              resources:
+                requests:
+                  storage: ${MONITORING_PROMETHEUS_PVC_SIZE}
+    grafana:
+      # Grafana behind Keycloak SSO (native OIDC) — ADR-0014. C2 UI composition (docs/12).
+      # TODO(WS-SEC/WS-C2): OIDC client + admin password from SOPS secret (name only).
+      enabled: true
+    alertmanager:
+      alertmanagerSpec: {}
+      # TODO(WS-OBS, Phase 4): Alertmanager → Gmail SMTP receiver; SMTP creds SOPS-encrypted (name
+      #   only). Reconciliation errors + drift are alerting conditions (R-OBS-04). Prove: injected
+      #   fault emails an alert (Phase-4 exit gate).