feat(observability): Prometheus/Alertmanager/Grafana/Loki stack

Self-hosted, no paid SaaS. Host/container/Postgres metrics, uptime probes
against the new /healthz endpoints, alert rules split critical (pages) vs
warning (informational), one starter Grafana dashboard. Deliberately
separate from the application's instructor learning analytics (Phase 3B) -
different audience, different data.

Validated: promtool check config (valid), promtool check rules (11 rules,
valid), amtool check-config (1 inhibit rule, 2 receivers, valid).

infra/monitoring/validate-monitoring.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# Local test (Phase 4 §29): renders prometheus.yml.j2 with dummy values and validates it plus
+# the alert rules with the REAL promtool (via the official Prometheus Docker image, no local
+# install needed). Also validates alertmanager.yml.j2 with amtool if the image supports it.
+set -euo pipefail
+cd "$(dirname "$0")"
+
+TMPDIR="$(mktemp -d)"
+trap 'rm -rf "$TMPDIR"' EXIT
+mkdir -p "$TMPDIR/rules"
+
+sed -e 's/{{ lab_host_ip }}/10.10.10.20/g' prometheus/prometheus.yml.j2 > "$TMPDIR/prometheus.yml"
+cp prometheus/rules/*.yml "$TMPDIR/rules/"
+chmod -R a+rX "$TMPDIR"
+
+echo "==> promtool check config"
+docker run --rm -v "$TMPDIR:/etc/prometheus:ro" --entrypoint promtool prom/prometheus:latest \
+  check config /etc/prometheus/prometheus.yml
+
+echo
+echo "==> amtool check-config (Alertmanager)"
+TMPDIR2="$(mktemp -d)"
+trap 'rm -rf "$TMPDIR" "$TMPDIR2"' EXIT
+sed -e "s/{{ vault_alertmanager_webhook_url | default('http:\/\/example.invalid\/webhook') }}/http:\/\/example.invalid\/webhook/g" \
+  alertmanager/alertmanager.yml.j2 > "$TMPDIR2/alertmanager.yml"
+chmod -R a+rX "$TMPDIR2"
+docker run --rm -v "$TMPDIR2:/etc/alertmanager:ro" --entrypoint amtool prom/alertmanager:latest \
+  check-config /etc/alertmanager/alertmanager.yml
+
+echo
+echo "OK: monitoring configs are valid"