feat(phase4): deploy monitoring (kube-prometheus-stack + Loki + Alloy + Alertmanager)

Enable monitoring in platform/kustomization.yaml (Phase 4). Grafana admin +
Alertmanager SMTP secrets are provisioned (SOPS) and wired; Longhorn SC is up for
Prometheus/Loki PVCs. Set the Alertmanager receiver 'to:' to a valid inbox
([email protected]) so the config loads (REPLACE-ME is not a valid address);
operator can change it. NOTE: smtp_from ([email protected]) differs from
the Gmail auth user — Gmail may reject/rewrite unless a send-as alias is configured;
that only affects email delivery at alert time, not stack health.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

platform/kustomization.yaml

@@ -17,8 +17,9 @@ resources:
   - cert-manager       # Let's Encrypt DNS-01 wildcard — needs SOPS `cloudflare-api-token`
   - externaldns        # auto DNS records — needs SOPS `cloudflare-api-token`
   - gateway            # Gateway API listeners (ingress; replaces Traefik)
-  # ---- Later phases: enabled when their phase opens (creds already provisioned via SOPS) ----
-  # - monitoring       # Phase 4 (Observability): kube-prometheus-stack + Loki + Alloy + Alertmanager
+  # ---- Phase 4 — Observability (creds provisioned via SOPS: grafana-admin, alertmanager-smtp) ----
+  - monitoring         # kube-prometheus-stack + Loki + Alloy + Alertmanager
+  # ---- Later phases: enabled when their phase opens ----
   # - velero           # Phase 4 (Backup/DR): BLOCKED on OQ-BKP (off-cluster backup target decision)
   # - image-automation # Phase 4 (Automated updates): Flux image-automation + Renovate
   # - kubevirt         # Phase 5 (IaaS proof): KubeVirt + CDI