Add metrics monitoring stack with VictoriaMetrics, Grafana, and node_exporter

Implement complete monitoring infrastructure following rick-infra principles:

Components:
- VictoriaMetrics: Prometheus-compatible TSDB (7x less RAM usage)
- Grafana: Visualization dashboard with Authentik OAuth/OIDC integration
- node_exporter: System metrics collection (CPU, memory, disk, network)

Architecture:
- All services run as native systemd binaries (no containers)
- localhost-only binding for security
- Grafana uses native OAuth integration with Authentik (not forward_auth)
- Full systemd security hardening enabled
- Proxied via Caddy at metrics.jnss.me with HTTPS

Role Features:
- Unified metrics role (single role for complete stack)
- Automatic role mapping via Authentik groups:
  - authentik Admins OR grafana-admins -> Admin access
  - grafana-editors -> Editor access
  - All others -> Viewer access
- VictoriaMetrics auto-provisioned as default Grafana datasource
- 12-month metrics retention by default
- Comprehensive documentation included

Security:
- OAuth/OIDC SSO via Authentik
- All metrics services bind to 127.0.0.1 only
- systemd hardening (NoNewPrivileges, ProtectSystem, etc.)
- Grafana accessible only via Caddy HTTPS proxy

Documentation:
- roles/metrics/README.md: Complete role documentation
- docs/metrics-deployment-guide.md: Step-by-step deployment guide

Configuration:
- Updated rick-infra.yml to include metrics deployment
- Grafana port set to 3001 (Gitea uses 3000)
- Ready for multi-host expansion (designed for future node_exporter deployment to production hosts)

rick-infra.yml

@@ -10,9 +10,11 @@
 # - Authentik SSO/authentication
 # - Gitea git hosting
 # - Vaultwarden password manager
+# - Metrics (VictoriaMetrics, Grafana, node_exporter)
 #
 # Usage:
-#   ansible-playbook playbooks/homelab.yml
+#   ansible-playbook rick-infra.yml
+#   ansible-playbook rick-infra.yml --tags metrics
 
 # - import_playbook: playbooks/security.yml
 - name: Deploy Homelab Infrastructure
@@ -21,10 +23,16 @@
   gather_facts: true
   
   tasks:
-    - name: Deploy Caddy
+    # - name: Deploy Caddy
+    #   include_role:
+    #     name: caddy
+    #   tags: ['caddy']
+
+    - name: Deploy Metrics Stack
       include_role:
-        name: caddy
-      tags: ['caddy']
+        name: metrics
+      tags: ['metrics', 'monitoring', 'grafana', 'victoriametrics']
+    
     # - name: Deploy Authentik
     #   include_role:
     #     name: authentik