feat(monitoring): enable Alertmanager (null receiver, longhorn PVC, az-a) + fix forgejo-rules ns forgejo->cicd — alerting delivery was disabled; forgejo PrometheusRule targeted a nonexistent namespace

k8s/infra/monitoring/alerts/svc-forgejo-rules.yaml

@@ -2,7 +2,7 @@ apiVersion: monitoring.coreos.com/v1
 kind: PrometheusRule
 metadata:
   name: forgejo-rules
-  namespace: forgejo
+  namespace: cicd
 spec:
   groups:
     - name: forgejo.rules

k8s/infra/monitoring/prometheus-values.yaml

@@ -20,8 +20,36 @@ grafana:
   enabled: false
 
 # ── Alertmanager ──────────────────────────────────────────────────────────────
+# Enabled with a default (null) receiver — every firing PrometheusRule lands in
+# the Alertmanager UI and Grafana's Alerting view; no external Slack/email/
+# PagerDuty notifier is wired yet (add a receiver + route later). Storage pinned
+# to az-a (sole Longhorn node) like Prometheus so the RWO PVC can attach.
 alertmanager:
-  enabled: false
+  enabled: true
+  alertmanagerSpec:
+    nodeSelector:
+      topology.kubernetes.io/zone: az-a
+    tolerations:
+      - key: node-role.kubernetes.io/control-plane
+        operator: Exists
+        effect: NoSchedule
+    storage:
+      volumeClaimTemplate:
+        spec:
+          storageClassName: longhorn
+          accessModes: ["ReadWriteOnce"]
+          resources:
+            requests:
+              storage: 2Gi
+  config:
+    route:
+      group_by: ["alertname", "namespace"]
+      group_wait: 30s
+      group_interval: 5m
+      repeat_interval: 4h
+      receiver: "null"
+    receivers:
+      - name: "null"
 
 # ── Prometheus ────────────────────────────────────────────────────────────────
 prometheus: