fix: consolidate helmfile into one file; expose gRPC externally for kmsvc-cli

Cross-file `needs:` across separate nested helmfiles didn't resolve in
Helmfile v1 (releases defined in sibling files weren't visible to each
other's dependency graph) -- confirmed live against the homelab cluster:
kafka-cluster failed with "depend(s) on an undefined release" even though
strimzi-operator had just been installed successfully by a sibling file.
Collapsed releases.d/*.gotmpl into a single helmfile.yaml.gotmpl so the
whole release graph is resolved together.

Also add a second Ingress (management-service-grpc, backend-protocol: GRPC)
scoped to the QueueService gRPC path prefix on the same host/port as the
REST ingress. kmsvc-cli dials --server directly via gRPC (default
kmsvc.homelab.internal:443 per its README), so raw gRPC needs an external
path too, not just REST -- the original "gRPC stays internal" default
didn't account for the CLI's own connection model.

Add Dockerfile.queue-operator (existed for cmd/server only before).

Dockerfile.queue-operator

@@ -0,0 +1,12 @@
+FROM golang:1.26 AS build
+WORKDIR /src
+ENV GOPRIVATE=forgejo.riotpiao.homelab.com
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+RUN CGO_ENABLED=0 go build -trimpath -o /out/queue-operator ./cmd/queue-operator
+
+FROM gcr.io/distroless/static-debian12:nonroot
+COPY --from=build /out/queue-operator /queue-operator
+USER nonroot:nonroot
+ENTRYPOINT ["/queue-operator"]