Port the observability platform to k3s and ship czy logs to it

k8s/ is now a faithful port of the mentor's Ansible Grafana stack
(Prometheus, Alertmanager, Loki, Tempo, Alloy, Grafana, node-exporter)
for the ledgerline-observability namespace on falken: same versions and
configs, one *.vione.cloud ingress per tool behind Traefik basic auth,
secrets generated by create-secrets.sh into gitignored files.

Two fixes over the Ansible role, both verified live: Tempo's
metrics-generator needs traces_storage or it runs no processors, and
Prometheus needs exemplar-storage to keep exemplars.

Ledgerline stays on czy; an Alloy agent in the Traefik override ships
its container logs to Loki. Roadmap and CLAUDE.md now point at k8s/.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

k8s/alloy/config.alloy

@@ -0,0 +1,35 @@
+// Port of ansible/roles/observability/templates/grafana-stack/config/alloy/config.alloy.j2.
+//
+// The Ansible config also tails container logs from the local Docker socket
+// (discovery.docker -> discovery.relabel -> loki.source.docker -> loki.write).
+// On k3s there is no Docker socket, and Ledgerline's containers run on czy
+// anyway, so that half lives in the czy-side agent:
+// observability/alloy-agent/config.alloy.
+//
+// What remains is unchanged: the OTLP receiver wires a `traces` output and
+// nothing else. OTLP metrics and logs are accepted and silently dropped.
+
+logging {
+  level = "info"
+}
+
+otelcol.receiver.otlp "default" {
+  grpc {
+    endpoint = "0.0.0.0:4317"
+  }
+  http {
+    endpoint = "0.0.0.0:4318"
+  }
+  output {
+    traces = [otelcol.exporter.otlp.tempo.input]
+  }
+}
+
+otelcol.exporter.otlp "tempo" {
+  client {
+    endpoint = "tempo:4317"
+    tls {
+      insecure = true
+    }
+  }
+}