Establish clean homelab infrastructure baseline

Reorganize the brownfield repository, remove retired and generated artifacts, harden ignore rules, and record the GitOps/IaC redesign.

platform/observability/grafana/oidc-secret.yaml

@@ -0,0 +1,18 @@
+# Plaintext OIDC client secret Grafana presents to Authelia. Authelia stores only the
+# pbkdf2-sha512 HASH of this same value (see authelia/values.yaml grafana client).
+#
+# Generate a matching pair:
+#   authelia crypto hash generate pbkdf2 --variant sha512 --random --random.length 72
+# Put the "Random Password" (plaintext) below; put the "Digest" (hash) in Authelia.
+#
+# Do NOT commit the real secret. Create it out-of-band instead, e.g.:
+#   kubectl -n monitoring create secret generic grafana-oidc \
+#     --from-literal=client_secret='<plaintext>'
+apiVersion: v1
+kind: Secret
+metadata:
+  name: grafana-oidc
+  namespace: monitoring
+type: Opaque
+stringData:
+  client_secret: "REPLACE_ME_WITH_PLAINTEXT_OIDC_SECRET"