gitops: observability stack (Loki/Promtail/Grafana), Grafana Ingress, Argo multi-source

- Add gitops/observability umbrella chart with vendored Helm deps
- Grafana Ingress: Traefik, letsencrypt-prod, grafana.k8s.selair.it + root_url
- Argo Application: spec.sources (onelab + onelab-obs)
- OneLab: configuration secret override, compliance/LDAP values, logs.path /logs
- Docs: OBSERVABILITY, BOOTSTRAP, README, instance-overrides example

Made-with: Cursor

gitops/argocd/application.yaml

@@ -1,4 +1,5 @@
-# Syncs chart from Git; ensure Argo CD can clone repoURL (add credentials in Argo if private).
+# Syncs OneLab app + observability (Loki/Promtail/Grafana) into namespace onelab.
+# Requires Argo CD 2.6+ (spec.sources). Ensure repoURL matches your remote.
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
@@ -8,13 +9,21 @@ metadata:
     - resources-finalizer.argocd.argoproj.io
 spec:
   project: default
-  source:
-    repoURL: https://git.luneski.fr/luneski/onelab-k8s.git
-    targetRevision: main
-    path: gitops/charts/onelab
-    helm:
-      valueFiles:
-        - ../../values/k3s-example.yaml
+  sources:
+    - repoURL: https://git.luneski.fr/luneski/onelab-k8s.git
+      targetRevision: main
+      path: gitops/charts/onelab
+      helm:
+        releaseName: onelab
+        valueFiles:
+          - ../../values/k3s-example.yaml
+    - repoURL: https://git.luneski.fr/luneski/onelab-k8s.git
+      targetRevision: main
+      path: gitops/observability
+      helm:
+        releaseName: onelab-obs
+        valueFiles:
+          - values.yaml
   destination:
     server: https://kubernetes.default.svc
     namespace: onelab