monitoring: expose Alloy OTLP for external log ingestion from RunPod pods

- Alloy config: route OTLP logs → Loki (was traces-only)
- Alloy config: fix River syntax (semicolons in rule{} blocks are invalid)
- Add alloy-otlp Service (ClusterIP:4318)
- Add alloy-otlp-auth Secret (bcrypt htpasswd for Traefik BasicAuth)
- Add alloy-otlp-basicauth-middleware Traefik Middleware
- Add alloy.neuralplatform.ai Ingress (TLS via cert-manager)
  Auth: Authorization: Basic base64(pantheon:<push_token>)
  Token stored in Vault at secret/alloy push_token

RunPod pods push OTLP logs to https://alloy.neuralplatform.ai/v1/logs
Alloy routes → Loki → queryable in Grafana

servers/legion/variables.tf

@@ -141,3 +141,9 @@ variable "gitea_runner_token" {
   type        = string
   sensitive   = true
 }
+
+variable "alloy_push_token" {
+  description = "Bearer token required to push OTLP logs/traces to alloy.neuralplatform.ai"
+  type        = string
+  sensitive   = true
+}