feat(grafana): bascule sur le domaine public HTTPS (grafana.funklab.online) (#90)

- IngressRoute websecure + Let's Encrypt
- OIDC : root_url + auth_url sur le domaine (token/api restent internes)

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

k8s/infra/monitoring/ingressroute-public.yaml

@@ -0,0 +1,18 @@
+# Accès public HTTPS — grafana.funklab.online (cert Let's Encrypt auto).
+# Route interne grafana.lab.local conservée (Ingress du chart, http).
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: grafana-public
+  namespace: monitoring
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`grafana.funklab.online`)
+      kind: Rule
+      services:
+        - name: kube-prometheus-stack-grafana
+          port: 80
+  tls:
+    certResolver: letsencrypt