Reconcile public Vault monitoring with proven deployment

[systemdbrew]

PR #6 was already merged, but its Vault observability implementation differed from the configuration subsequently proven on the live KernelCafe cluster.

This reconciles the public repository with the tested design:

• move Vault ServiceMonitor and PrometheusRule resources out of Vault Helm values into infrastructure/vault/monitoring.yaml
• add a dedicated vault-monitoring Argo CD Application
• select the headless vault-internal service with vault-internal: "true", which exposes all three HA members individually
• keep the named http scrape port and /v1/sys/metrics?format=prometheus
• colocate all five Vault-specific alerts, including VaultManualRolloutPending
• keep the generic StatefulSet rollout replacement focused on non-Vault StatefulSets
• update the Vault operations runbook to describe the proven design

Live validation performed before this public reconciliation:

• 3/3 Vault scrape targets UP
• 3/3 vault_core_unsealed = 1
• exactly one vault_core_active = 1
• all five Vault alert rules loaded with health ok
• no Vault alerts firing

No secrets or environment-specific credentials are added.