Grafana

This draft keeps the operations side of a monitoring rollout intact: install kube-prometheus, expose the main services, add alerting configuration, and adjust the RBAC when the cluster needs broader access than the defaults provide.

This draft captures a practical bare-metal monitoring setup: install kube-prometheus, remove or adjust the network policies that block outside access, add MetalLB, convert the services to LoadBalancer, and patch the RBAC where the stock install is not enough for the cluster.