fix: pin PVCs to existing PVs; fix kube-prometheus-stack grafana auth

PVC manifests: add volumeName to bind new PVCs to existing PVs whose
old PVCs were accidentally deleted during Terraform->ArgoCD migration.
All PVs patched to Retain to prevent data loss on pod restart.

kube-prometheus-stack: replace invalid adminPassword.valueFrom.secretKeyRef
(Helm values don't support k8s secretKeyRef syntax) with correct
admin.existingSecret + admin.passwordKey pattern.

servers/legion/apps/kube-prometheus-stack.yaml

@@ -12,11 +12,9 @@ spec:
     helm:
       values: |
         grafana:
-          adminPassword:
-            valueFrom:
-              secretKeyRef:
-                name: grafana-admin-secret
-                key: admin-password
+          admin:
+            existingSecret: grafana-admin-secret
+            passwordKey: admin-password
           persistence:
             enabled: true
             size: 5Gi