feat: add ingress-nginx, demo-app, Chaos Mesh apps and Grafana alert rules

WP-14(Terraform 설계서 7.3, 실험·앱 설계서 3.1·4.3).
- apps/ingress-nginx: baremetal 매니페스트(controller-v1.15.1)를 kustomize로 가져와
  NodePort 30080/30443 고정(ALB TG와 일치).
- apps/demo-app + workloads/demo-app: front(nginx-unprivileged 1.31.6, 정적 페이지 +
  /api/ 프록시) 2, api(demo-api:8f5378b) 3 + PDB minAvailable 2, Service, Ingress(/ front,
  /api api). DB_DSN은 Secret demo-db(make k8s-secrets로 생성, git 밖).
- apps/chaos-mesh: Helm chart 2.8.4(containerd 소켓, dashboard 없음).
- vm/observability/grafana/provisioning/alerting: contact point harness-webhook
  (10.20.0.11:8080/hooks/alert), 루트 정책, 규칙 8건(ProbeDown·ApiLatencyHigh·
  ApiErrorRateHigh·PodCrashLooping·LegacyUnhealthy·DbReplicationLag·DbPrimaryDown·
  GitOpsDrift, 라벨 layer/signature).

workloads/ingress-nginx/kustomization.yaml

@@ -0,0 +1,18 @@
+# ingress-nginx baremetal (NodePort) provider manifest, pinned; NodePorts fixed so the ALB target group (30080) matches.
+# https://kubernetes.github.io/ingress-nginx/deploy/baremetal/
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.15.1/deploy/static/provider/baremetal/deploy.yaml
+patches:
+  - target:
+      kind: Service
+      name: ingress-nginx-controller
+      namespace: ingress-nginx
+    patch: |-
+      - op: add
+        path: /spec/ports/0/nodePort
+        value: 30080
+      - op: add
+        path: /spec/ports/1/nodePort
+        value: 30443