fix: pin PVCs to existing PVs; fix kube-prometheus-stack grafana auth

PVC manifests: add volumeName to bind new PVCs to existing PVs whose
old PVCs were accidentally deleted during Terraform->ArgoCD migration.
All PVs patched to Retain to prevent data loss on pod restart.

kube-prometheus-stack: replace invalid adminPassword.valueFrom.secretKeyRef
(Helm values don't support k8s secretKeyRef syntax) with correct
admin.existingSecret + admin.passwordKey pattern.

servers/legion/k8s/packages/pvc.yaml

@@ -5,6 +5,8 @@ metadata:
   name: verdaccio-data
   namespace: packages
 spec:
+  storageClassName: local-path
+  volumeName: pvc-3eb09a5d-3e2f-4d5e-a5ca-9e0a11d03795
   accessModes:
     - ReadWriteOnce
   resources:
@@ -17,6 +19,8 @@ metadata:
   name: devpi-data
   namespace: packages
 spec:
+  storageClassName: local-path
+  volumeName: pvc-4685c41f-5936-459f-a468-09d775296e5d
   accessModes:
     - ReadWriteOnce
   resources: