fix: pin PVCs to existing PVs; fix kube-prometheus-stack grafana auth

PVC manifests: add volumeName to bind new PVCs to existing PVs whose
old PVCs were accidentally deleted during Terraform->ArgoCD migration.
All PVs patched to Retain to prevent data loss on pod restart.

kube-prometheus-stack: replace invalid adminPassword.valueFrom.secretKeyRef
(Helm values don't support k8s secretKeyRef syntax) with correct
admin.existingSecret + admin.passwordKey pattern.

servers/legion/k8s/adguard/pvc.yaml

@@ -5,6 +5,8 @@ metadata:
   name: adguard-config
   namespace: dns
 spec:
+  storageClassName: local-path
+  volumeName: pvc-471e439b-2a69-49fc-9704-4dec6df93855
   accessModes:
     - ReadWriteOnce
   resources:
@@ -17,6 +19,8 @@ metadata:
   name: adguard-data
   namespace: dns
 spec:
+  storageClassName: local-path
+  volumeName: pvc-8b8c53fb-b16d-4896-8827-042b7bcbe2dd
   accessModes:
     - ReadWriteOnce
   resources: