Port the observability platform to k3s and ship czy logs to it

k8s/ is now a faithful port of the mentor's Ansible Grafana stack
(Prometheus, Alertmanager, Loki, Tempo, Alloy, Grafana, node-exporter)
for the ledgerline-observability namespace on falken: same versions and
configs, one *.vione.cloud ingress per tool behind Traefik basic auth,
secrets generated by create-secrets.sh into gitignored files.

Two fixes over the Ansible role, both verified live: Tempo's
metrics-generator needs traces_storage or it runs no processors, and
Prometheus needs exemplar-storage to keep exemplars.

Ledgerline stays on czy; an Alloy agent in the Traefik override ships
its container logs to Loki. Roadmap and CLAUDE.md now point at k8s/.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

k8s/kustomization.yaml

@@ -0,0 +1,26 @@
+# Ledgerline observability platform on k3s (falken).
+#
+# A port of the mentor's Ansible Grafana stack
+# (ansible/roles/observability/templates/grafana-stack/): same versions, same
+# configs, same pipeline behaviour. Service names match the compose service
+# names so every in-config URL ports unchanged.
+#
+#   ./create-secrets.sh          # once: basic-auth + Grafana admin secrets
+#   kubectl apply -k k8s/        # deploy / re-apply after a config change
+#
+# See README.md.
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: ledgerline-observability
+
+resources:
+  - namespace.yaml
+  - auth
+  - prometheus
+  - alertmanager
+  - loki
+  - tempo
+  - alloy
+  - grafana
+  - node-exporter