feat(grafana): move cert alerting onto the upstream blueprint

[themightychris]

Migrates live's cert alerting from a local release-values override (PR #178) to the cluster-template blueprint, so live, sandbox, and every future cluster share one source of truth.

What changes

• civic-cloud pin v1.9.2 → v1.10.1 — brings cluster-template v1.6.1's alerting (rules, Postmark SMTP, pinned datasource UID, GF_SMTP_FROM_NAME) into live's blueprint.
• grafana/release-values.yaml stripped to just the live-specific bits (ingress: false, server domain). The SMTP config, envValueFrom, datasources, and the 5 alert rules all come from the blueprint now.
• grafana-smtp Secret replaces the local smtp-postmark — same Postmark token, re-keyed to the template convention (user/password/from-address/recipients/from-name). from-name = "CFP Live Cluster".
• Old smtp-postmark SealedSecret removed.

QA

The civic-cloud bump touches only grafana (empty non-grafana diff). Grafana diff:

M grafana/ConfigMap/grafana.yaml     # alerting now blueprint-sourced
M grafana/Deployment/grafana.yaml    # env from grafana-smtp, +GF_SMTP_FROM_NAME
A grafana/SealedSecret/grafana-smtp.yaml
D grafana/SealedSecret/smtp-postmark.yaml

Verified: rules present, {{ $labels }} summaries render literal, live's metrics.live.k8s.phl.io server domain preserved. Runtime from_name resolves to "CFP Live Cluster" via the secret (env overrides the blueprint's generic ini default — same mechanism validated on sandbox).

After deploy: confirm rules load and fire a test to verify delivery + sender name.