docs: close out the roadmap items this run finished

[Gerrrt]

Documentation only — nothing that runs changes.

Moved to Done

• Put Grafana behind TLS — done in feat(observability): serve Grafana over TLS with the lab CA #35, verified end to end. Recorded with
  the detail that matters: Prometheus verifies it with ca_file and
  server_name, not insecure_skip_verify.

Added to Done (real work, never tracked as roadmap items)

• Alertmanager points at a real receiver (chore(secrets): point Alertmanager at a real receiver #31). The webhook was the
  ntfy.example.invalid placeholder for the entire life of the stack, so no
  alert had ever been delivered.
• Dashboards surface firing alerts (No dashboard shows firing alerts — add an Alertmanager panel #36, feat(observability): show firing alerts on every dashboard #37, fix(observability): show alerts with a table, not the alert list panel #38). Forty rules and a
  routing tree existed with nothing showing them.
• The UPS dashboard stops reporting a battery that is not there (fix(observability): stop the UPS dashboard reporting a battery that isn't there #30) — the
  management card fabricates charge, runtime and status.

Corrected

The SNMP rotation Done entry said three of four devices. All four are
rotated. The switch also still accepts its previous community — an accepted
residual recorded in SECURITY.md, not an omission. "Three of four" hid both
halves of that.

Sharpened

The ifXTable item gains what a future attempt needs:

• it is newly actionable — the switch has only been polling at all since the
  three stacked faults in neo (MokerLink, 10.7.7.2) stopped answering SNMP — ICMP and TCP/80 succeed, UDP/161 does not #22 were cleared;
• it has a trap — this firmware returns ifSpecific with a zero-length value
  that makes snmp-exporter discard the whole GETBULK response, so the walk
  enumerates individual columns and must stay clear of column 22.

Deliberately left open

SNMPv3 authPriv (blocked on the switch), egress filtering, the MokerLink’s
residual community, the UPS battery, Alloy rollout, blackbox-exporter, the
10.0.30.10 Proxmox/iLO ambiguity, dashboard screenshots, and everything under
Infrastructure and Automation.

Blast radius

None.

• No change to network segmentation or firewall rules
• No new port published to a VLAN that could not already reach the service
• No credential added outside secrets/*.sops.yaml

Verification

./scripts/validate.sh passes; markdownlint-cli2 clean.

• make validate passes
• Deployed to the lab — n/a, docs only
• Docs updated