Add VictoriaMetrics observability stack + sync catalog for monitoring test

- VM stack 10 charts: victoria-metrics-cluster/auth, victoria-logs-cluster,
  victoria-metrics-agent/alert, opentelemetry-collector, kube-state-metrics,
  prometheus-node-exporter, alertmanager, perses (JWT/OIDC, Infisical-ready)
- ArgoCD ApplicationSet (syncWave) + per-chart dip-values overlays
- doc/victoria-metrics-architecture.md, define-chart-resources updates
- includes pending working-tree changes (mlflow, kubeflow, apisix, CLAUDE.md)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

manifests/helm/mlflow/1.9.0/files/mlflow-apisix-redirect.yaml

@@ -0,0 +1,19 @@
+# APISIX http→https redirect 플러그인 (클러스터의 다른 네임스페이스와 동일한 https-redirect 관례).
+# Ingress 의 annotation `k8s.apisix.apache.org/plugin-config-name: https-redirect` 가 이 리소스를 참조한다.
+#
+# CORS 는 mlflow 앱 네이티브 설정(extraArgs.corsAllowedOrigins)으로 처리하므로
+# ingress 레벨 cors 플러그인은 사용하지 않는다.
+#
+# 주의: mlflow-oidc-auth 는 *앱 레벨* 에서 OIDC 인증을 처리하므로
+#       ingress 에 openid-connect / keycloak-authz 플러그인을 추가하지 않는다.
+apiVersion: apisix.apache.org/v2
+kind: ApisixPluginConfig
+metadata:
+  name: https-redirect
+  namespace: mlflow
+spec:
+  plugins:
+    - name: redirect
+      enable: true
+      config:
+        http_to_https: true

manifests/helm/mlflow/1.9.0/files/mlflow_workspace_detector.py

@@ -0,0 +1,23 @@
+import base64
+import json
+
+
+def get_user_workspaces(access_token: str) -> list:
+    """
+    JWT access_token의 groups 클레임에서 mlflow-team-* 그룹을 읽어
+    workspace 이름 목록을 반환한다.
+
+    예: ["mlflow-team-ds", "mlflow"] → ["team-ds"]
+    """
+    try:
+        payload = access_token.split(".")[1]
+        payload += "=" * (4 - len(payload) % 4)
+        claims = json.loads(base64.b64decode(payload))
+    except Exception:
+        return []
+    groups = claims.get("groups", [])
+    return [
+        g[len("mlflow-"):]
+        for g in groups
+        if g.startswith("mlflow-team-")
+    ]