Initial Grafana role, split out of ansible-role-eom

Moves the Grafana Helm deployment and LDAP template out of
ericomeehan.eom into its own role, and:

- maps cn=DevOps Members,ou=Teams to Editor in the DevOps org (org 2),
  after DevOps Owners so owners keep Admin
- pins chart 11.4.2 from Bitnami's OCI registry (the HTTP index no
  longer carries it) so redeploys don't upgrade to Grafana 12
- pins the bitnamilegacy/grafana image the cluster is already running

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -0,0 +1,59 @@
+ansible-role-grafana
+====================
+
+Deploys Grafana to the eom.dev Kubernetes cluster with the Bitnami Helm chart,
+with LDAP sign-in mapped to Grafana organizations.
+
+Requirements
+------------
+
+- `kubernetes.core` collection, Helm on the target host
+- OpenLDAP at `openldap.openldap.svc.cluster.local`
+- Prometheus and Alertmanager in the `prometheus` namespace
+
+Role Variables
+--------------
+
+Required (from `secrets.yaml`):
+
+- `grafana_admin_password`
+- `openldap_readonly_password`
+
+Defaults (`defaults/main.yml`):
+
+| Variable | Default |
+|---|---|
+| `grafana_chart_ref` | `oci://registry-1.docker.io/bitnamicharts/grafana` |
+| `grafana_chart_version` | `11.4.2` |
+| `grafana_image_repository` | `bitnamilegacy/grafana` |
+| `grafana_image_tag` | `11.4.0-debian-12-r0` |
+| `grafana_domain` | `grafana.eom.dev` |
+
+LDAP group mappings
+-------------------
+
+Defined in `templates/ldap.toml.j2`. Grafana uses the first mapping that
+matches per organization, so owner groups must come before member groups.
+
+| LDAP group | Org | Role |
+|---|---|---|
+| Grafana Administrators | 1 (Main) | Admin + server admin |
+| Grafana Users | 1 (Main) | Viewer |
+| DevOps Owners | 2 (DevOps) | Admin |
+| DevOps Members | 2 (DevOps) | Editor |
+| Finance Owners | 3 (Finance) | Admin |
+
+Example Playbook
+----------------
+
+    - hosts: alpha-control-plane
+      become: true
+      vars_files:
+        - ../secrets.yaml
+      roles:
+        - role: ericomeehan.grafana
+
+License
+-------
+
+MIT-0