feat(wireguard): add Grafana as a second proxy target

Exactly the case proxyTargets was built for — a map entry, no new
templates. Peers reach Grafana at 10.100.0.1:3000 once the tunnel is up,
same mechanism as OpenBao on :8200.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017ZMCuQ5t9hdrmUctLk7hEv

Author: 2 people

services/platform/wireguard/config/values.yaml

@@ -66,6 +66,9 @@ proxyTargets:
   openbao:
     port: 8200
     target: "openbao.openbao.svc.cluster.local:8200"
+  grafana:
+    port: 3000
+    target: "kube-prometheus-stack-grafana.monitoring.svc.cluster.local:80"
 
 # name -> {publicKey, allowedIPs}. One entry per peer minted by infra repo's
 # 04-vpn/wireguard (`terraform output -json peer_public_keys`) — public