Initial Grafana role, split out of ansible-role-eom

Moves the Grafana Helm deployment and LDAP template out of
ericomeehan.eom into its own role, and:

- maps cn=DevOps Members,ou=Teams to Editor in the DevOps org (org 2),
  after DevOps Owners so owners keep Admin
- pins chart 11.4.2 from Bitnami's OCI registry (the HTTP index no
  longer carries it) so redeploys don't upgrade to Grafana 12
- pins the bitnamilegacy/grafana image the cluster is already running

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tasks/main.yml

@@ -0,0 +1,66 @@
+#SPDX-License-Identifier: MIT-0
+---
+# tasks file for ansible-role-grafana
+- name: Deploy Grafana
+  kubernetes.core.helm:
+    name: grafana
+    chart_ref: "{{ grafana_chart_ref }}"
+    chart_version: "{{ grafana_chart_version }}"
+    release_namespace: grafana
+    create_namespace: true
+    values:
+      image:
+        repository: "{{ grafana_image_repository }}"
+        tag: "{{ grafana_image_tag }}"
+      metrics:
+        enabled: true
+      admin:
+        user: grafana_admin
+        password: "{{ grafana_admin_password }}"
+      persistence:
+        size: 64Gi
+      grafana:
+        extraEnvVars:
+          - name: GF_SERVER_DOMAIN
+            value: "{{ grafana_domain }}"
+          - name: GF_SERVER_ROOT_URL
+            value: "https://{{ grafana_domain }}/"
+      smtp:
+        enabled: true
+        user: grafana
+        password: "{{ grafana_admin_password }}"
+        host: mail.eom.dev:587
+        fromAddress: grafana@eom.dev
+        fromName: Grafana
+      ldap:
+        enabled: true
+        allowSignUp: true
+        configuration: "{{ lookup('template', 'ldap.toml.j2') }}"
+      ingress:
+        enabled: true
+        pathType: Prefix
+        hostname: "{{ grafana_domain }}"
+        annotations:
+          cert-manager.io/cluster-issuer: ca-issuer
+        ingressClassName: nginx
+        tls: true
+      datasources:
+        secretDefinition:
+          apiVersion: 1
+          datasources:
+            - name: Prometheus
+              type: prometheus
+              access: proxy
+              orgId: 1
+              url: http://prometheus-server.prometheus.svc.cluster.local
+              version: 1
+              editable: true
+              isDefault: true
+            - name: Alertmanager
+              uid: alertmanager
+              type: alertmanager
+              access: proxy
+              orgId: 1
+              url: http://prometheus-alertmanager.prometheus.svc.cluster.local
+              version: 1
+              editable: true