grafana: deploy Grafana instance, datasource and dashboards

Deploys Grafana in the observability project via the grafana-operator,
mirroring the puppet Grafana but modernised: CNPG for state and Authentik
OIDC for auth. Ports the live datasource + dashboards in as CRs.

Changes (apps/base/grafana):
- CNPG postgres Cluster + rw Pooler (db grafana), plus VaultAuth +
  VaultStaticSecrets pulling postgres/oauth credentials from Vault.
- Grafana CR: postgres backend via the pooler, Authentik generic_oauth
  (client id/secret from the Vault-synced secret, openid/email/profile
  scopes, group->role mapping), root_url grafana.k8s.syd1.au.unkin.net.
- Single GrafanaDatasource (k8s VictoriaMetrics via the operator vmselect
  service); reuses the previous default datasource uid so imported
  dashboards resolve without edits.
- 13 GrafanaDashboards (gzipJson) exported from the current grafana.
- Gateway API (traefik-internal) + HTTPRoute for grafana.k8s.syd1.au.unkin.net.
- Register apps/overlays/*/grafana in the observability ApplicationSet and
  add the grafana namespace to the project destinations.

apps/base/grafana/gateway.yaml

@@ -0,0 +1,39 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: grafana
+  namespace: grafana
+  labels:
+    app.kubernetes.io/name: grafana
+    app.kubernetes.io/instance: grafana
+    traefik.io/instance: internal
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: grafana.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: grafana.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - name: http
+      port: 80
+      protocol: HTTP
+      hostname: grafana.k8s.syd1.au.unkin.net
+      allowedRoutes:
+        namespaces:
+          from: Same
+    - name: https
+      port: 443
+      protocol: HTTPS
+      hostname: grafana.k8s.syd1.au.unkin.net
+      allowedRoutes:
+        namespaces:
+          from: Same
+      tls:
+        mode: Terminate
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: grafana-tls