Port the observability platform to k3s and ship czy logs to it

k8s/ is now a faithful port of the mentor's Ansible Grafana stack
(Prometheus, Alertmanager, Loki, Tempo, Alloy, Grafana, node-exporter)
for the ledgerline-observability namespace on falken: same versions and
configs, one *.vione.cloud ingress per tool behind Traefik basic auth,
secrets generated by create-secrets.sh into gitignored files.

Two fixes over the Ansible role, both verified live: Tempo's
metrics-generator needs traces_storage or it runs no processors, and
Prometheus needs exemplar-storage to keep exemplars.

Ledgerline stays on czy; an Alloy agent in the Traefik override ships
its container logs to Loki. Roadmap and CLAUDE.md now point at k8s/.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/roadmap/phase-8.md

@@ -73,8 +73,10 @@ come from measured numbers, not be picked from thin air).
 2. Implement recording rules for the SLIs and **multi-burn-rate alert rules**.
    Your platform ships **Alertmanager** plus a Prometheus rules directory and the
    sample rules `HostExporterDown` and `HostHighCPU`, so the grain is
-   *Prometheus rule files → Alertmanager*, templated by the Ansible role, with
-   `alertmanager_webhook_url` in `group_vars` for delivery. Follow the grain — but
+   *Prometheus rule files → Alertmanager*. In the k3s port, rule files live in
+   `k8s/prometheus/rules/` (add each one to the `prometheus-rules` generator)
+   and delivery is a receiver in `k8s/alertmanager/alertmanager.yml` (the role's
+   `alertmanager_webhook_url`). Follow the grain — but
    be able to argue the alternative: Grafana unified alerting can evaluate across
    datasources (including Loki queries) and lives with your dashboards, whereas
    Alertmanager is metrics-only but is the ecosystem standard and gives you