Milestone 10: add observability, alerts, runbooks, and final project polish

[nhatminh06]

Summary

• install pinned Prometheus, Alertmanager, Grafana, and node_exporter components
• scrape native Patroni, mutual-TLS etcd, HAProxy, and seven-host resource metrics
• publish stable PgSentry semantic metrics for primary count, replicas, byte lag, DCS health, writable routing, backup age, and WAL archival
• add 12 actionable alert rules mapped to nine operational runbooks
• provision three Grafana dashboards and the Prometheus datasource entirely from Git
• consolidate M1-M10 architecture, evidence, operations, demo, limitations, and README narrative

Canonical runtime acceptance

• fresh full topology: 7 VMs / 30 Terraform resources
• Prometheus targets: 15/15 UP
• healthy values: primary=1, replicas=2, etcd=3/3, writable backend=1
• backup timestamp and WAL archive metrics populated from a real full backup
• replica-loss alert fired in Prometheus/Alertmanager and resolved
• one-etcd-member-loss alert fired at 2/3, quorum remained, and resolved at 3/3
• HAProxy-loss alert fired without database failover and resolved after route recovery
• bounded one-standby recovery pause produced 16,777,040 bytes lag; alert fired and resolved after catch-up
• final firing alerts: 0
• final PostgreSQL/Patroni, etcd, HAProxy, backup/archive regression: passed

Validation and cleanup

• Prometheus config and 12 rules validated with pinned promtool 3.13.1
• Alertmanager config validated with pinned amtool 0.33.1
• Grafana JSON and all runbook references validated
• Go, pgsafe fixtures, Terraform, shell, Python, and diff checks passed
• monitoring/backup runtime data removed; all 30 Terraform resources destroyed
• final Terraform state, project domains, networks, volumes, and .pgsentry state: zero/absent

This final milestone PR is intentionally left open for review and must not be merged automatically.