k8s/monitoring: add prometheus grafana loki observability

- Loki log aggregation (MinIO backed, 10-day retention)
- Promtail daemonset (pod + talos journal logs)
- Prometheus + kube-state-metrics
- Grafana dashboards (6-row template per service)

k8s/logging/.env.example

@@ -0,0 +1,13 @@
+# logging/.env.example
+# Copy to logging/.env and fill in real values.
+# The real .env is gitignored — never commit it.
+# Used by: k8s/logging/bootstrap.sh and k8s/monitoring/bootstrap.sh (Grafana upgrade step)
+
+# Grafana admin UI password
+#   openssl rand -base64 24
+GRAFANA_ADMIN_PASSWORD=
+
+# MinIO credentials — must match the values used in k8s/storage/.env
+# Loki uses these to authenticate to the MinIO S3 backend
+MINIO_ROOT_USER=
+MINIO_ROOT_PASSWORD=