add: metrics-server for kubectl top / HPA

Metrics API (metrics.k8s.io) wasn't registered, so kubectl top failed with
'Metrics API not available'. kube-state-metrics from kube-prometheus-stack
doesn't provide it. Uses --kubelet-insecure-tls since kubeadm kubelets serve
self-signed certs (no serverTLSBootstrap), and scrapes kubelets by
InternalIP.

manifests/metrics-server/values.yaml

@@ -0,0 +1,12 @@
+# Serves the Metrics API (metrics.k8s.io) behind `kubectl top` and HPA.
+# Not the same as kube-state-metrics (kube-prometheus-stack) — that one only
+# exports object state to Prometheus, it doesn't register the Metrics API.
+args:
+  # Kubelets were bootstrapped by kubeadm without serverTLSBootstrap, so
+  # their serving certs are self-signed (not issued by the cluster CA) —
+  # metrics-server can't verify them. Drop this flag only after enabling
+  # serverTLSBootstrap on every kubelet + approving the serving CSRs.
+  - --kubelet-insecure-tls
+  # Nodes have no DNS-resolvable hostnames from inside the cluster; scrape
+  # kubelets by InternalIP (192.168.1.3x) instead.
+  - --kubelet-preferred-address-types=InternalIP