feat(alerting): convert 3 hand-authored VMRules to Grafana alert rules (#559) (#24)

Adds terraform/alerting-converted-vmrules.tf with grafana_rule_group
resources reproducing the three VMRule CRDs that today are vmalert-evaluated
with no non-paging delivery path:

  - keycloak-dr-backup       -> KeycloakRealmBackupStale (severity=ticket)
  - tailscale-operator       -> TailscaleOperatorDown / TailscaleProxyCrashLoop
                                / TailscaleOAuthSecretSyncErrors (severity=warning)
  - cert-expiry-euc1         -> EUC1CertExpiringIn14Days / EUC1CertNotReady
                                (severity=ticket)

Each rule runs the original PromQL expr against the VictoriaMetrics
datasource (P4169E866C3094E38) in the A step, reduces to last in B, and
fires on C threshold > 0 (the source exprs already bake the comparison into
a boolean-ish series). Pattern matches the applied alerting-euc1-dr.tf.

severity=warning/ticket labels route via the EXISTING non-paging policy
(pagerduty-platform-infra-low -> low-urgency PD -> Slack #mzla-pages). The
notification policy is not modified.

The paired platform-infrastructure PR removing the VMRule YAMLs must merge
AFTER these rules are applied, to avoid an alerting gap.

Relates: thunderbird/platform-infrastructure#559

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: aatchison