feat: add vault, external-secrets, monitoring, harbor, jenkins, sonarqube, headlamp

Two-source ArgoCD Applications (upstream chart + values from this repo),
same pattern as cluster-bootstrap. Each service paired with a *-config
Application for HTTPRoute/RBAC/ClusterSecretStore that must exist
after the main install (separate sync wave).

Chart targetRevision pins and HTTPRoute backendRef service names are
best-effort - marked TODO/verify in-file since no live helm repo access
this session to confirm current versions or actual rendered svc names.

manifests/kube-prometheus-stack/values.yaml

@@ -0,0 +1,26 @@
+grafana:
+  persistence:
+    enabled: true
+    storageClassName: nfs-delete
+    size: 5Gi
+
+prometheus:
+  prometheusSpec:
+    storageSpec:
+      volumeClaimTemplate:
+        spec:
+          storageClassName: nfs-delete
+          resources:
+            requests:
+              storage: 20Gi
+    retention: 15d
+
+alertmanager:
+  alertmanagerSpec:
+    storage:
+      volumeClaimTemplate:
+        spec:
+          storageClassName: nfs-delete
+          resources:
+            requests:
+              storage: 2Gi