feat(observability): Prometheus/Alertmanager/Grafana/Loki stack

Self-hosted, no paid SaaS. Host/container/Postgres metrics, uptime probes
against the new /healthz endpoints, alert rules split critical (pages) vs
warning (informational), one starter Grafana dashboard. Deliberately
separate from the application's instructor learning analytics (Phase 3B) -
different audience, different data.

Validated: promtool check config (valid), promtool check rules (11 rules,
valid), amtool check-config (1 inhibit rule, 2 receivers, valid).

infra/monitoring/promtail/promtail-config.lab-host.yml.j2

@@ -0,0 +1,38 @@
+# Promtail on rn-lab-host-01 — same shape as promtail-config.platform.yml, but pushes to Loki
+# over the network (Loki lives on rn-platform-01, not locally) since these two hosts don't
+# share a Docker network. {{ platform_ip }} is an Ansible variable, rendered by the lab-host
+# role — see infra/firewall/rn-platform-01.rules for the matching inbound rule (3100, this
+# host's IP only).
+
+server:
+  http_listen_port: 9080
+
+positions:
+  filename: /tmp/positions.yaml
+
+clients:
+  - url: "http://{{ platform_ip }}:3100/loki/api/v1/push"
+
+scrape_configs:
+  - job_name: docker
+    docker_sd_configs:
+      - host: unix:///var/run/docker.sock
+        refresh_interval: 15s
+    relabel_configs:
+      - source_labels: [__meta_docker_container_name]
+        target_label: container
+      - source_labels: [__meta_docker_container_label_com_docker_compose_service]
+        target_label: service
+    pipeline_stages:
+      - replace:
+          expression: '(?i)(password|token|secret)=[^&\s]+'
+          replace: '$1=***REDACTED***'
+
+  - job_name: journal
+    journal:
+      max_age: 24h
+      labels:
+        job: systemd-journal
+    relabel_configs:
+      - source_labels: [__journal__systemd_unit]
+        target_label: unit