fix(grafana): roll Grafana to load the OIDC client-secret (R-IDP-01)

Grafana's pod predated the grafana-oidc-credentials secret, so generic_oauth started with
an empty client_secret (disabled) → /login/generic_oauth didn't redirect to Keycloak.
Add a podAnnotation to force one roll; bump on future OIDC secret changes.

platform/monitoring/kube-prometheus-stack.yaml

@@ -126,6 +126,11 @@ spec:
     # --- Grafana: dashboards (R-OBS-03), surfaced in the C2 UI (docs/12) behind Keycloak SSO ---
     grafana:
       enabled: true
+      # Force a pod roll when the OIDC wiring changes so Grafana loads the grafana-oidc-credentials
+      # client-secret (env valueFrom is resolved at pod start; the secret was added after first boot, so
+      # generic_oauth started disabled). Bump this value to re-roll Grafana on future OIDC secret changes.
+      podAnnotations:
+        homelab.keithjackson.dev/oidc-rollout: "1"
       # Admin bootstrap + (later) OIDC client are SOPS secrets referenced BY NAME (WS-SEC/ADR-0014).
       admin:
         existingSecret: grafana-admin-credentials