grafana: deploy Grafana instance, datasource and dashboards

Deploys Grafana in the observability project via the grafana-operator,
mirroring the puppet Grafana but modernised: CNPG for state and Authentik
OIDC for auth. Ports the live datasource + dashboards in as CRs.

Changes (apps/base/grafana):
- CNPG postgres Cluster + rw Pooler (db grafana), plus VaultAuth +
  VaultStaticSecrets pulling postgres/oauth credentials from Vault.
- Grafana CR: postgres backend via the pooler, Authentik generic_oauth
  (client id/secret from the Vault-synced secret, openid/email/profile
  scopes, group->role mapping), root_url grafana.k8s.syd1.au.unkin.net.
- Single GrafanaDatasource (k8s VictoriaMetrics via the operator vmselect
  service); reuses the previous default datasource uid so imported
  dashboards resolve without edits.
- 13 GrafanaDashboards (gzipJson) exported from the current grafana.
- Gateway API (traefik-internal) + HTTPRoute for grafana.k8s.syd1.au.unkin.net.
- Register apps/overlays/*/grafana in the observability ApplicationSet and
  add the grafana namespace to the project destinations.

apps/base/grafana/grafanadatasource.yaml

@@ -0,0 +1,22 @@
+---
+apiVersion: grafana.integreatly.org/v1beta1
+kind: GrafanaDatasource
+metadata:
+  name: victoriametrics
+  namespace: grafana
+spec:
+  instanceSelector:
+    matchLabels:
+      dashboards: "grafana"
+  # uid matches the previous default datasource so the imported dashboards
+  # (which hardcode this uid or use the default) resolve without edits.
+  datasource:
+    name: "VictoriaMetrics"
+    type: "prometheus"
+    uid: "det2y55dac4jkc"
+    access: "proxy"
+    url: "http://vmselect-main.observability.svc.cluster.local:8481/select/0/prometheus"
+    isDefault: true
+    jsonData:
+      timeInterval: "15s"
+      httpMethod: "POST"