Everything-is-an-app cutover: Monitoring group (prometheus, grafana, promtail, alertmanager, otel)

Nobody has claimed this yet.

## Parent

linode/apl-core#3515

## What to build

Cut the **Monitoring** group of core apps over to the new git-driven layout. These apps are grouped because they share the same cross-cutting managed setting beyond the universal four: alerting / monitoring wiring (`alerts.*`).

Apps in this batch:
- `prometheus`
- `grafana`
- `promtail`
- `alertmanager`
- `otel`

Note: `grafana` is also an OIDC consumer — coordinate its OIDC managed-values wiring with the SSO/OIDC batch. `loki` is handled in the Storage & Database batch.

End-to-end behavior per app: `enabled` in `env/settings/apps.yaml`; vendor-shaped `values.custom.yaml` + operator-rendered `values.managed.yaml` under `env/values///`; multi-source `Application` CR file; legacy `env/apps/.yaml` + inline-values path removed. Any secret material (SMTP/webhook creds, grafana admin) appears only as Secret references — value files stay secret-free.

## Acceptance criteria

- [ ] Each app reconciles Healthy in ArgoCD from its `env/values///{managed,custom}.yaml`.
- [ ] `alerts` / monitoring wiring emitted into `values.managed.yaml`; secrets only as references.
- [ ] grafana also emits OIDC references (cross-dependency with the SSO/OIDC batch noted and handled).
- [ ] Legacy `env/apps/.yaml` entries and inline-values path removed for this batch.
- [ ] Existing `installed:` gating still works from `env/settings/apps.yaml`.

## Blocked by

- linode/apl-core#3571
- linode/apl-core#3572
- linode/apl-core#3573

Start with env/settings/apps.yaml and the existing env/values/// layout, then review the parent issue and blocked issues before changing the Monitoring batch. Verify each app's multi-source Application, managed/custom values, installed gating, secret references, and removal of legacy env/apps/.yaml entries by confirming Healthy reconciliation in ArgoCD.

Written by the indexing model from the issue text.