Grafana cluster deployment

Argo CD owns the Grafana Helm release and the dashboard ConfigMaps in resources/. The selected upstream chart version is recorded once in bootstrap/grafana.yaml; change it there to upgrade.

The existing grafana Secret supplies the admin credentials, while grafana-postgres-secret supplies database and OAuth credentials. They are referenced by name and must remain cluster-managed; do not add their data to this public repository. The prior Helm release record is retained for recovery and must not be upgraded or uninstalled after Argo adoption.