fix: pin PVCs to existing PVs; fix kube-prometheus-stack grafana auth

PVC manifests: add volumeName to bind new PVCs to existing PVs whose
old PVCs were accidentally deleted during Terraform->ArgoCD migration.
All PVs patched to Retain to prevent data loss on pod restart.

kube-prometheus-stack: replace invalid adminPassword.valueFrom.secretKeyRef
(Helm values don't support k8s secretKeyRef syntax) with correct
admin.existingSecret + admin.passwordKey pattern.

Agents.md

@@ -264,7 +264,8 @@ Add `helm_release` resource to appropriate `.tf` file, apply.
 
 ## Network
 
-- Subnet: `192.168.68.x` (TP-Link Deco, router mode)
+- Router: TP-Link Deco BE5000 mesh, router mode
+- Subnet: `192.168.68.x`
 - DHCP DNS: `192.168.68.77` (AdGuard) + `1.1.1.1` fallback
 - AdGuard provides `*.nook.family` resolution → `192.168.68.77`
 - Cloudflare tunnel ID: `54bc9b05-3953-47a2-9c3e-adecdcc53d51`

servers/legion/apps/kube-prometheus-stack.yaml

@@ -12,11 +12,9 @@ spec:
     helm:
       values: |
         grafana:
-          adminPassword:
+          admin:
-            valueFrom:
+            existingSecret: grafana-admin-secret
-              secretKeyRef:
+            passwordKey: admin-password
-                name: grafana-admin-secret
-                key: admin-password
           persistence:
             enabled: true
             size: 5Gi

servers/legion/k8s/adguard/pvc.yaml

@@ -5,6 +5,8 @@ metadata:
   name: adguard-config
   namespace: dns
 spec:
+  storageClassName: local-path
+  volumeName: pvc-471e439b-2a69-49fc-9704-4dec6df93855
   accessModes:
     - ReadWriteOnce
   resources:
@@ -17,6 +19,8 @@ metadata:
   name: adguard-data
   namespace: dns
 spec:
+  storageClassName: local-path
+  volumeName: pvc-8b8c53fb-b16d-4896-8827-042b7bcbe2dd
   accessModes:
     - ReadWriteOnce
   resources:

servers/legion/k8s/gitea/pvc.yaml

@@ -4,6 +4,8 @@ metadata:
   name: gitea-data
   namespace: git
 spec:
+  storageClassName: local-path
+  volumeName: pvc-d21681f5-eeb3-4252-9db7-34218cd5c155
   accessModes:
     - ReadWriteOnce
   resources:

servers/legion/k8s/headscale/pvc.yaml

@@ -4,6 +4,8 @@ metadata:
   name: headscale-data
   namespace: headscale
 spec:
+  storageClassName: local-path
+  volumeName: pvc-0577c988-84d6-40d2-889e-38b3e98fc0c7
   accessModes:
     - ReadWriteOnce
   resources:

servers/legion/k8s/neuron/pvc.yaml

@@ -4,6 +4,8 @@ metadata:
   name: neuron-data
   namespace: neuron
 spec:
+  storageClassName: local-path
+  volumeName: pvc-87da7604-ee6b-49cb-a2f8-cdc7bff0f81d
   accessModes:
     - ReadWriteOnce
   resources:

servers/legion/k8s/ollama/pvc.yaml

@@ -4,6 +4,8 @@ metadata:
   name: ollama-models
   namespace: ollama
 spec:
+  storageClassName: local-path
+  volumeName: pvc-8678c279-9ca0-4d2c-ae87-863c50fd32f5
   accessModes:
     - ReadWriteOnce
   resources:

servers/legion/k8s/packages/pvc.yaml

@@ -5,6 +5,8 @@ metadata:
   name: verdaccio-data
   namespace: packages
 spec:
+  storageClassName: local-path
+  volumeName: pvc-3eb09a5d-3e2f-4d5e-a5ca-9e0a11d03795
   accessModes:
     - ReadWriteOnce
   resources:
@@ -17,6 +19,8 @@ metadata:
   name: devpi-data
   namespace: packages
 spec:
+  storageClassName: local-path
+  volumeName: pvc-4685c41f-5936-459f-a468-09d775296e5d
   accessModes:
     - ReadWriteOnce
   resources:

servers/legion/k8s/registry/pvc.yaml

@@ -4,6 +4,8 @@ metadata:
   name: registry-data
   namespace: registry
 spec:
+  storageClassName: local-path
+  volumeName: pvc-3d44fdad-2aa8-4761-8811-15b69802744d
   accessModes:
     - ReadWriteOnce
   resources: