observability: add k8s API/kubelet tracing, Alloy, Mimir and Loki

Wire kube-apiserver and kubelet tracing to a Jaeger collector on
docker-29, deploy Grafana Alloy in-cluster to ship logs/metrics, and
stand up Mimir + Loki on docker-30 as their backing stores.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

vms-home/docker-30/loki/docker-compose.yaml

@@ -0,0 +1,41 @@
+services:
+  loki:
+    image: grafana/loki:3.7.3
+    container_name: loki
+    restart: unless-stopped
+    user: "10001:10001"
+    command:
+      - -config.file=/etc/loki/config.yaml
+      - -config.expand-env=true                # REQUIRED — expands ${GARAGE_*}
+    ports:
+      - "3100:3100"                            # LAN IP, not 0.0.0.0 — push+query
+    volumes:
+      - ./loki-config.yaml:/etc/loki/config.yaml:ro
+      - ./loki-data:/loki                       # WAL / tsdb-index / compactor scratch
+    env_file: [.env]                            # GARAGE_ACCESS_KEY / GARAGE_SECRET_KEY
+    networks: [obs]
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO- http://localhost:3100/ready || exit 1"]
+      interval: 15s
+      timeout: 5s
+      retries: 10
+      start_period: 30s
+    logging:                                    # don't let Loki's own logs balloon
+      driver: json-file
+      options: { max-size: "10m", max-file: "3" }
+
+  grafana:                                      # optional — drop if you query elsewhere
+    image: grafana/grafana:13.1.0
+    container_name: grafana
+    restart: unless-stopped
+    ports:
+      - "3001:3000" # LAN IP, not               # 3000 is taken by gitea
+    volumes:
+      - grafana-data:/var/lib/grafana
+    networks: [obs]
+
+volumes:
+  grafana-data:
+
+networks:
+  obs: { driver: bridge }