feat(phase4): deploy monitoring (kube-prometheus-stack + Loki + Alloy + Alertmanager)

Enable monitoring in platform/kustomization.yaml (Phase 4). Grafana admin +
Alertmanager SMTP secrets are provisioned (SOPS) and wired; Longhorn SC is up for
Prometheus/Loki PVCs. Set the Alertmanager receiver 'to:' to a valid inbox
([email protected]) so the config loads (REPLACE-ME is not a valid address);
operator can change it. NOTE: smtp_from ([email protected]) differs from
the Gmail auth user — Gmail may reject/rewrite unless a send-as alias is configured;
that only affects email delivery at alert time, not stack health.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

platform/monitoring/kustomization.yaml

@@ -8,3 +8,5 @@ resources:
   - loki.yaml
   - alloy.yaml
   - alerts.yaml
+  - grafana-admin-credentials.sops.yaml
+  - alertmanager-smtp.sops.yaml