Port the observability platform to k3s and ship czy logs to it

k8s/ is now a faithful port of the mentor's Ansible Grafana stack
(Prometheus, Alertmanager, Loki, Tempo, Alloy, Grafana, node-exporter)
for the ledgerline-observability namespace on falken: same versions and
configs, one *.vione.cloud ingress per tool behind Traefik basic auth,
secrets generated by create-secrets.sh into gitignored files.

Two fixes over the Ansible role, both verified live: Tempo's
metrics-generator needs traces_storage or it runs no processors, and
Prometheus needs exemplar-storage to keep exemplars.

Ledgerline stays on czy; an Alloy agent in the Traefik override ships
its container logs to Loki. Roadmap and CLAUDE.md now point at k8s/.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/roadmap/phase-11.md

@@ -14,8 +14,8 @@ Babak gave you a task; deliver it like an engineer, not like a student.
 1. **`README.md`** — architecture diagram, one-command start, what each container is
    for, and a "here's the demo" script.
 2. **The five-minute demo path**, rehearsed:
-   - Delete every dashboard in the Grafana UI, then `ansible-playbook
-     playbooks/grafana-stack.yml` — the whole platform and every dashboard rebuilt
+   - Delete every dashboard in the Grafana UI (or the whole namespace), then
+     `kubectl apply -k k8s/` — the whole platform and every dashboard rebuilt
      from code, one command.
    - Submit one transaction from the frontend, then follow it through Grafana: RED
      dashboard → latency spike → exemplar → trace → span → logs for that span → back