Add VictoriaMetrics observability stack + sync catalog for monitoring test

- VM stack 10 charts: victoria-metrics-cluster/auth, victoria-logs-cluster,
  victoria-metrics-agent/alert, opentelemetry-collector, kube-state-metrics,
  prometheus-node-exporter, alertmanager, perses (JWT/OIDC, Infisical-ready)
- ArgoCD ApplicationSet (syncWave) + per-chart dip-values overlays
- doc/victoria-metrics-architecture.md, define-chart-resources updates
- includes pending working-tree changes (mlflow, kubeflow, apisix, CLAUDE.md)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

manifests/helm/perses/0.21.0/templates/cluster-role-and-binding.yaml

@@ -0,0 +1,49 @@
+{{- if .Values.sidecar.enabled }}
+{{- $nsConfig := dict "customEnv" false }}
+{{- range .Values.sidecar.extraEnvVars }}
+  {{- if eq .name "NAMESPACE" }}
+    {{- $_ := set $nsConfig "customEnv" true }}
+  {{- end }}
+{{- end }}
+{{- $hasCustomNamespaceEnv := $nsConfig.customEnv }}
+{{- $clusterScope := or .Values.sidecar.allNamespaces $hasCustomNamespaceEnv }}
+{{- $roleKind := ternary "ClusterRole" "Role" $clusterScope }}
+{{- $bindingKind := ternary "ClusterRoleBinding" "RoleBinding" $clusterScope }}
+{{- $roleName := ternary (printf "%s-clusterrole" (include "perses.fullname" .)) (printf "%s-role" (include "perses.fullname" .)) $clusterScope }}
+{{- $bindingName := ternary (printf "%s-clusterrolebinding" (include "perses.fullname" .)) (printf "%s-rolebinding" (include "perses.fullname" .)) $clusterScope }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: {{ $roleKind }}
+metadata:
+  name: {{ $roleName }}
+  {{- if not $clusterScope }}
+  namespace: {{ .Release.Namespace }}
+  {{- end }}
+  labels:
+    {{- include "perses.labels" . | nindent 4 }}
+    app.kubernetes.io/component: iam
+rules:
+- apiGroups: [""]
+  resources: ["configmaps"]
+  verbs: ["get", "watch", "list"]
+{{- if .Values.sidecar.enableSecretAccess }}
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["get", "watch", "list"]
+{{- end }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: {{ $bindingKind }}
+metadata:
+  name: {{ $bindingName }}
+  {{- if not $clusterScope }}
+  namespace: {{ .Release.Namespace }}
+  {{- end }}
+roleRef:
+  kind: {{ $roleKind }}
+  name: {{ $roleName }}
+  apiGroup: rbac.authorization.k8s.io
+subjects:
+- kind: ServiceAccount
+  name: {{ include "perses.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+{{- end }}