Add grafana appSpec entry and its admin-credentials ExternalSecret

Matches the chart-side addition in devops-infra-helm-charts. The
ExternalSecret needs its Vault path populated before either this or
the grafana Application syncs — see that file's own header for the
exact vault kv put command, same requirement postgres and every other
admin credential in this repo already has.

app-of-secretstores.yaml is automated (prune: true), so this new
secretstore file needs no separate manual sync of its own — only that
app-of-apps wrapper, same as any other new file under secretstores/.

Verified with `helm template` against generic-argo-apps-chart and this
values file: 12 Applications render, grafana present and correctly
formed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Wajog7nELA3i8JWTjxYGHF

values/incubator-infra-k8s-admin-prd-ase1-values.yaml

@@ -176,4 +176,21 @@ appSpec:
     nameOverride: node-exporter
     namespace: monitoring
     chartDir: node-exporter
-    valuesDir: node-exporter
+    valuesDir: node-exporter
+  - name: grafana
+    # Dashboards over VictoriaMetrics — see that chart for why "type:
+    # prometheus" is correct for a VictoriaMetrics URL. This directory
+    # already held a fully-vendored old Grafana chart (v6.58.7) from the
+    # original Meesho monorepo import with generic production config
+    # (fullnameOverride: grafana-infra-prd) — removed and re-vendored
+    # fresh as a thin wrapper, same treatment as victoria-metrics-single.
+    #
+    # Requires secretstores/grafana-admin-credentials.yaml to have synced
+    # first — the pod falls back to a randomly-generated admin password
+    # nobody has if that Secret does not exist yet when it boots (not a
+    # crash, just an inaccessible login until the Secret exists and the
+    # pod restarts).
+    nameOverride: grafana
+    namespace: monitoring
+    chartDir: grafana
+    valuesDir: grafana