Reduce on-NAS config.alloy to a secret-free remotecfg bootstrap

## Summary
Once the Fleet Management pipelines serve the truenas collector (#281), shrink the on-NAS `config.alloy` to a `remotecfg` bootstrap with env-var-referenced secrets, commit the secret-free bootstrap, and configure `gcx` `cloud.token` for inspection. Step 3 of 3 splitting the original #150 goal.

## Motivation
Dissolves the "how do I back up the Grafana-Cloud-held config?" problem — the Terraform is the backup — and removes the plaintext Grafana Cloud push tokens from the on-NAS file. `config.alloy` currently lives only on the NAS: not backed up, carrying plaintext secrets.

## Scope
- Reduce `config.alloy` to a `remotecfg` block + env-var references for secrets (`GCLOUD_RW_API_KEY` + remote_write tokens, injected via the TrueNAS app env / 1Password).
- Commit the secret-free bootstrap.
- Configure `gcx` `cloud.token` so `gcx fleet collectors/pipelines` works for inspection.
- Deploy the reduced config to the NAS and restart the alloy app.

## Open questions
- Where does the committed bootstrap live? No NAS-config-management mechanism exists in this repo (chezmoi manages the workstation, not the NAS). Proposal: a reference artifact (e.g. `truenas/alloy/config.alloy`) deployed to the NAS manually — confirm the home.

## Acceptance criteria
- [ ] `config.alloy` reduced to an env-ref'd `remotecfg` bootstrap (no plaintext secrets).
- [ ] Secret-free bootstrap committed.
- [ ] `gcx` `cloud.token` configured; `gcx fleet collectors/pipelines` returns the truenas collector + pipelines.

## Additional context
Step 3 of 3. Blocked by #281 (Terraform FM pipelines) — the pipelines must be served via Fleet Management before the local config can be safely stripped to a bootstrap. Related: #144 (backup/DR), alunduil-chezmoi#363 (MCP credential pattern).