grafana: deploy Grafana instance, datasource and dashboards

Deploys Grafana in the observability project via the grafana-operator,
mirroring the puppet Grafana but modernised: CNPG for state and Authentik
OIDC for auth. Ports the live datasource + dashboards in as CRs.

Changes (apps/base/grafana):
- CNPG postgres Cluster + rw Pooler (db grafana), plus VaultAuth +
  VaultStaticSecrets pulling postgres/oauth credentials from Vault.
- Grafana CR: postgres backend via the pooler, Authentik generic_oauth
  (client id/secret from the Vault-synced secret, openid/email/profile
  scopes, group->role mapping), root_url grafana.k8s.syd1.au.unkin.net.
- Single GrafanaDatasource (k8s VictoriaMetrics via the operator vmselect
  service); reuses the previous default datasource uid so imported
  dashboards resolve without edits.
- 13 GrafanaDashboards (gzipJson) exported from the current grafana.
- Gateway API (traefik-internal) + HTTPRoute for grafana.k8s.syd1.au.unkin.net.
- Register apps/overlays/*/grafana in the observability ApplicationSet and
  add the grafana namespace to the project destinations.

apps/base/grafana/cnpg_cluster.yaml

@@ -0,0 +1,58 @@
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: postgres
+  namespace: grafana
+spec:
+  affinity:
+    podAntiAffinityType: preferred
+  bootstrap:
+    initdb:
+      database: grafana
+      encoding: UTF8
+      localeCType: C
+      localeCollate: C
+      owner: grafana
+      secret:
+        name: postgres-credentials
+  enablePDB: true
+  enableSuperuserAccess: false
+  failoverDelay: 0
+  imageName: ghcr.io/cloudnative-pg/postgresql:18.1-system-trixie
+  instances: 2
+  logLevel: info
+  monitoring:
+    customQueriesConfigMap:
+      - key: queries
+        name: cnpg-default-monitoring
+    disableDefaultQueries: false
+    enablePodMonitor: false
+  postgresql:
+    parameters:
+      max_connections: "200"
+      shared_buffers: 128MB
+  primaryUpdateMethod: restart
+  primaryUpdateStrategy: unsupervised
+  replicationSlots:
+    highAvailability:
+      enabled: true
+      slotPrefix: _cnpg_
+    synchronizeReplicas:
+      enabled: true
+    updateInterval: 30
+  resources:
+    limits:
+      cpu: 500m
+      memory: 512Mi
+    requests:
+      cpu: 100m
+      memory: 256Mi
+  smartShutdownTimeout: 180
+  startDelay: 3600
+  stopDelay: 1800
+  storage:
+    resizeInUseVolumes: true
+    size: 10Gi
+    storageClass: cephrbd-fast-delete
+  switchoverDelay: 3600