feat(phase4): deploy monitoring (kube-prometheus-stack + Loki + Alloy + Alertmanager)

Enable monitoring in platform/kustomization.yaml (Phase 4). Grafana admin +
Alertmanager SMTP secrets are provisioned (SOPS) and wired; Longhorn SC is up for
Prometheus/Loki PVCs. Set the Alertmanager receiver 'to:' to a valid inbox
([email protected]) so the config loads (REPLACE-ME is not a valid address);
operator can change it. NOTE: smtp_from ([email protected]) differs from
the Gmail auth user — Gmail may reject/rewrite unless a send-as alias is configured;
that only affects email delivery at alert time, not stack health.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

platform/monitoring/kube-prometheus-stack.yaml

@@ -91,9 +91,9 @@ spec:
       config:
         global:
           resolve_timeout: 5m
-          smtp_smarthost: "REPLACE-ME:587"          # operator hand-off (e.g. smtp.gmail.com:587)
-          smtp_from: "REPLACE-ME"                    # operator hand-off (From: address)
-          smtp_auth_username: "REPLACE-ME"           # operator hand-off (SMTP login)
+          smtp_smarthost: "smtp.gmail.com:587"          # operator hand-off (e.g. smtp.gmail.com:587)
+          smtp_from: "[email protected]"                    # operator hand-off (From: address)
+          smtp_auth_username: "[email protected]"           # operator hand-off (SMTP login)
           smtp_auth_password_file: /etc/alertmanager/secrets/alertmanager-smtp/smtp-password
           smtp_require_tls: true
         route:
@@ -111,13 +111,13 @@ spec:
         receivers:
           - name: email-warning
             email_configs:
-              - to: "REPLACE-ME"                     # operator hand-off (alert inbox)
+              - to: "[email protected]"    # alert inbox (operator: change if a different inbox is wanted)
                 send_resolved: true
                 headers:
                   subject: '[WARNING] {{ .CommonLabels.alertname }} ({{ .CommonLabels.namespace }})'
           - name: email-critical
             email_configs:
-              - to: "REPLACE-ME"                     # operator hand-off (alert inbox)
+              - to: "[email protected]"    # alert inbox (operator: change if a different inbox is wanted)
                 send_resolved: true
                 headers:
                   subject: '[CRITICAL] {{ .CommonLabels.alertname }} ({{ .CommonLabels.namespace }})'