grafana: deploy Grafana instance, datasource and dashboards

Deploys Grafana in the observability project via the grafana-operator,
mirroring the puppet Grafana but modernised: CNPG for state and Authentik
OIDC for auth. Ports the live datasource + dashboards in as CRs.

Changes (apps/base/grafana):
- CNPG postgres Cluster + rw Pooler (db grafana), plus VaultAuth +
  VaultStaticSecrets pulling postgres/oauth credentials from Vault.
- Grafana CR: postgres backend via the pooler, Authentik generic_oauth
  (client id/secret from the Vault-synced secret, openid/email/profile
  scopes, group->role mapping), root_url grafana.k8s.syd1.au.unkin.net.
- Single GrafanaDatasource (k8s VictoriaMetrics via the operator vmselect
  service); reuses the previous default datasource uid so imported
  dashboards resolve without edits.
- 13 GrafanaDashboards (gzipJson) exported from the current grafana.
- Gateway API (traefik-internal) + HTTPRoute for grafana.k8s.syd1.au.unkin.net.
- Register apps/overlays/*/grafana in the observability ApplicationSet and
  add the grafana namespace to the project destinations.

apps/base/grafana/grafana.yaml

@@ -0,0 +1,60 @@
+---
+apiVersion: grafana.integreatly.org/v1beta1
+kind: Grafana
+metadata:
+  name: grafana
+  namespace: grafana
+  labels:
+    dashboards: "grafana"
+spec:
+  deployment:
+    spec:
+      template:
+        spec:
+          containers:
+            - name: grafana
+              env:
+                # DB password + OAuth client secret injected from the
+                # Vault-synced secrets (GF_ env overrides grafana.ini).
+                - name: GF_DATABASE_PASSWORD
+                  valueFrom:
+                    secretKeyRef:
+                      name: postgres-credentials
+                      key: password
+                - name: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET
+                  valueFrom:
+                    secretKeyRef:
+                      name: oauth-credentials
+                      key: client_secret
+              resources:
+                requests:
+                  cpu: 100m
+                  memory: 256Mi
+                limits:
+                  cpu: "1"
+                  memory: 1Gi
+  config:
+    server:
+      root_url: "https://grafana.k8s.syd1.au.unkin.net"
+    database:
+      type: "postgres"
+      host: "postgres-pooler-rw.grafana.svc.cluster.local:5432"
+      name: "grafana"
+      user: "grafana"
+      ssl_mode: "require"
+    auth:
+      disable_login_form: "false"
+      oauth_auto_login: "false"
+    "auth.generic_oauth":
+      enabled: "true"
+      name: "Authentik"
+      allow_sign_up: "true"
+      use_pkce: "true"
+      client_id: "grafana"
+      scopes: "openid email profile"
+      auth_url: "https://identity.unkin.net/application/o/authorize/"
+      token_url: "https://identity.unkin.net/application/o/token/"
+      api_url: "https://identity.unkin.net/application/o/userinfo/"
+      # Authentik groups -> Grafana roles (adjust group name as needed).
+      role_attribute_path: "contains(groups[*], 'grafana-admins') && 'Admin' || 'Viewer'"
+      role_attribute_strict: "false"