feat: bootstrap ArgoCD + structure GitOps k8s

- k8s/argocd-bootstrap/values.yaml : ArgoCD Helm values (ingress Traefik,
  resources limités, dex désactivé)
- k8s/apps-of-apps/ : root Application + monitoring Application
- k8s/infra/monitoring/ : kube-prometheus-stack v85.0.2 (Grafana, Prometheus,
  AlertManager, node-exporter daemonset)
  - Scrape additionnels : storage-01:9100, gpu-01:9100 (node), :9101 (ROCm),
    llama-server :1234/:1236/:1237
  - AlertManager webhook → http://192.168.10.1:9093/webhook (Hermes monitor)
  - Ressources dimensionnées pour compute 8GB
  - kubeEtcd/Scheduler/ControllerManager/Proxy désactivés (Talos)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

k8s/infra/monitoring/values.yaml

@@ -0,0 +1,140 @@
+# kube-prometheus-stack — cluster Funk
+# Ressources limitées pour compute-02/03 (8 GB RAM)
+
+grafana:
+  ingress:
+    enabled: true
+    ingressClassName: traefik
+    hosts:
+      - grafana.lab.local
+  adminPassword: "funk-grafana"
+  resources:
+    requests:
+      cpu: 100m
+      memory: 128Mi
+    limits:
+      memory: 256Mi
+  persistence:
+    enabled: false
+
+prometheus:
+  prometheusSpec:
+    retention: 15d
+    retentionSize: "8GB"
+    resources:
+      requests:
+        cpu: 200m
+        memory: 512Mi
+      limits:
+        memory: 1Gi
+    storageSpec:
+      volumeClaimTemplate:
+        spec:
+          accessModes: ["ReadWriteOnce"]
+          resources:
+            requests:
+              storage: 20Gi
+
+    # Scrape des nœuds hors cluster (storage-01, gpu-01)
+    additionalScrapeConfigs:
+      - job_name: storage-01
+        static_configs:
+          - targets: ['192.168.10.1:9100']
+            labels:
+              instance: storage-01
+              role: gateway
+
+      - job_name: gpu-01-node
+        static_configs:
+          - targets: ['192.168.10.20:9100']
+            labels:
+              instance: gpu-01
+              role: gpu
+
+      - job_name: gpu-01-rocm
+        static_configs:
+          - targets: ['192.168.10.20:9101']
+            labels:
+              instance: gpu-01
+              role: gpu
+
+      - job_name: llama-server-gpu
+        static_configs:
+          - targets: ['192.168.10.20:1234']
+            labels:
+              instance: gpu-01
+              model: qwen3-8b
+              type: gpu
+
+      - job_name: llama-server-system
+        static_configs:
+          - targets: ['192.168.10.20:1236']
+            labels:
+              instance: gpu-01
+              model: qwen3-1.7b-system
+              type: cpu
+
+      - job_name: llama-server-monitor
+        static_configs:
+          - targets: ['192.168.10.20:1237']
+            labels:
+              instance: gpu-01
+              model: qwen3-1.7b-monitor
+              type: cpu
+
+alertmanager:
+  alertmanagerSpec:
+    resources:
+      requests:
+        cpu: 50m
+        memory: 64Mi
+      limits:
+        memory: 128Mi
+  config:
+    global:
+      resolve_timeout: 5m
+    route:
+      group_by: ['alertname', 'instance']
+      group_wait: 30s
+      group_interval: 5m
+      repeat_interval: 4h
+      receiver: hermes-monitor
+    receivers:
+      - name: hermes-monitor
+        webhook_configs:
+          - url: 'http://192.168.10.1:9093/webhook'
+            send_resolved: true
+
+prometheusOperator:
+  resources:
+    requests:
+      cpu: 100m
+      memory: 128Mi
+    limits:
+      memory: 256Mi
+
+kube-state-metrics:
+  resources:
+    requests:
+      cpu: 50m
+      memory: 64Mi
+    limits:
+      memory: 128Mi
+
+nodeExporter:
+  resources:
+    requests:
+      cpu: 50m
+      memory: 32Mi
+    limits:
+      memory: 64Mi
+
+# Désactiver etcd/scheduler monitoring (Talos — non accessible)
+kubeEtcd:
+  enabled: false
+kubeScheduler:
+  enabled: false
+kubeControllerManager:
+  enabled: false
+kubeProxy:
+  enabled: false