feat(observability): Prometheus/Alertmanager/Grafana/Loki stack

Self-hosted, no paid SaaS. Host/container/Postgres metrics, uptime probes
against the new /healthz endpoints, alert rules split critical (pages) vs
warning (informational), one starter Grafana dashboard. Deliberately
separate from the application's instructor learning analytics (Phase 3B) -
different audience, different data.

Validated: promtool check config (valid), promtool check rules (11 rules,
valid), amtool check-config (1 inhibit rule, 2 receivers, valid).

infra/monitoring/loki/loki-config.yml

@@ -0,0 +1,36 @@
+# Minimal single-binary Loki config — local filesystem storage, no external dependency, sized
+# for this deployment (a handful of services' logs, not internet-scale ingestion).
+# Retention is set here, not left to grow forever — see docs/OBSERVABILITY.md §"retention."
+
+auth_enabled: false
+
+server:
+  http_listen_port: 3100
+
+common:
+  path_prefix: /loki
+  storage:
+    filesystem:
+      chunks_directory: /loki/chunks
+      rules_directory: /loki/rules
+  replication_factor: 1
+  ring:
+    kvstore:
+      store: inmemory
+
+schema_config:
+  configs:
+    - from: 2024-01-01
+      store: tsdb
+      object_store: filesystem
+      schema: v13
+      index:
+        prefix: index_
+        period: 24h
+
+limits_config:
+  retention_period: 720h   # 30 days — matches Prometheus's default retention (production.yml var)
+
+compactor:
+  working_directory: /loki/compactor
+  retention_enabled: true