[Phase 0] flux: add postBuild.substituteFrom for grafana-admin secret

Adds postBuild.substituteFrom to the Flux Kustomization reference manifest
so that ${GRAFANA_ADMIN_PASSWORD} in flux/monitoring/helmrelease.yaml is
substituted from the grafana-admin secret at reconcile time.

Without this block Flux passes the literal string to the Helm chart, causing
Grafana to start with a broken admin password.

The live copy in 0xWheatyz/Talos at
testing1/first-cluster/cluster/flux/api-company-source/kustomization.yaml
must also be updated with the same block (companion to issue #90).

Closes leeworks-agents/api-company#97

docs/tooling.md

@@ -0,0 +1,74 @@
+# Tooling Versions
+
+> Phase 0 checklist item — documents the local agent container tooling and confirms git remote config.
+> Live cluster verification (kubectl/flux against the running cluster) requires operator confirmation.
+
+## Agent Container Tooling
+
+| Tool | Version | Source |
+|------|---------|--------|
+| Node.js | v22.22.2 | `node --version` |
+| Python 3 | 3.11.2 | `python3 --version` |
+| Helm | v3.21.0 | `helm version --short` |
+| Flux CLI | v2.4.0 | `flux version --client` |
+| kustomize | v5.6.0 | `kustomize version` |
+| kubectl | available | `kubectl` (cluster context not set in agent container — live commands require kubeconfig from operator) |
+
+## Git Remote Config
+
+```
+origin   ssh://git@gitea.leeworks.dev/leeworks-agents/api-company (fetch)
+origin   ssh://git@gitea.leeworks.dev/leeworks-agents/api-company (push)
+upstream ssh://git@gitea.leeworks.dev/0xWheatyz/api-company (fetch)
+upstream ssh://git@gitea.leeworks.dev/0xWheatyz/api-company (push)
+```
+
+Remote `origin` confirmed pointing to `gitea.leeworks.dev/leeworks-agents/api-company`.
+
+> Note: `0xWheatyz/api-company` upstream repo does not yet exist on Gitea — tracked by issue #47.
+
+## Stack Summary
+
+### Runtime choices
+
+| API Service | Runtime | Rationale |
+|-------------|---------|-----------|
+| zip-enrichment | Node.js (Fastify) | Lightweight, fast JSON serialisation; large ZIP dataset fits SQLite well |
+| holidays | Node.js (Fastify) | Simple lookup API; Fastify handles high req/s with low memory |
+| air-quality | Python (FastAPI) | AQI ingestion benefits from Python data-science ecosystem |
+| docs-site | Astro (static) | Zero-runtime static site; built by CI, served from container |
+
+### Helm chart registry
+
+All HelmReleases use charts sourced from public Helm chart repositories declared in `flux/` as `HelmRepository` resources:
+
+- `flux/gitea-runner/helmrepository.yaml` — Gitea Act Runner chart
+- `flux/monitoring/` — `kube-prometheus-stack` and Gatus charts
+- `flux/zip-enrichment/`, `flux/holidays/`, `flux/air-quality/` — per-API service charts
+
+The in-cluster container registry is `registry.leeworks.dev` (Gitea built-in packages/container registry, documented in `docs/registry.md`).
+
+### Flux version and bootstrap
+
+- **Flux CLI**: v2.4.0 (available in agent container for manifest authoring)
+- **Flux controllers**: bootstrapped into `0xWheatyz/Talos` cluster (FluxCD v2.x)
+  - `flux-system` namespace managed by Talos GitOps repo
+  - Flux watches `0xWheatyz/Talos` → `testing1/first-cluster/cluster/`
+  - `api-company-source` GitRepository + Kustomization adds this repo to Flux (issues #2, #90)
+- **Bootstrap reference**: `0xWheatyz/Talos` repo — see Talos cluster documentation
+
+## Live Verification (Operator)
+
+The following commands require a valid `kubeconfig` (not available in agent container):
+
+```bash
+kubectl config current-context          # confirm cluster context
+kubectl version --client                # kubectl client version
+flux check                              # Flux controller health
+flux get sources git api-company        # GitRepository READY status
+flux get kustomizations api-company     # Kustomization READY status
+helm version                            # Helm client version
+kustomize version                       # kustomize version
+```
+
+_Reference: MASTER_BUILD_PROMPT.md §Phase 0 step 2 — Closes leeworks-agents/api-company#94_

flux/api-company-source/kustomization.yaml

@@ -1,7 +1,8 @@
 # This manifest is FOR REFERENCE — the live version must be committed to
-# 0xWheatyz/Talos at testing1/first-cluster/cluster/flux/api-company/
+# 0xWheatyz/Talos at testing1/first-cluster/cluster/flux/api-company-source/
 #
 # See leeworks-agents/api-company#2
+# See leeworks-agents/api-company#97
 
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -17,3 +18,8 @@ spec:
   prune: true
   wait: true
   timeout: 5m
+  postBuild:
+    substituteFrom:
+      - kind: Secret
+        name: grafana-admin
+        optional: false

flux/docs-site/kustomization.yaml

@@ -2,5 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - namespace.yaml
-  - helmrepository.yaml
   - helmrelease.yaml

flux/kustomization.yaml

@@ -1,6 +1,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+  - bedag-helmrepository.yaml
   - external-secrets
   - gitea-runner
   - monitoring

flux/monitoring/prometheusrule-apis.yaml

@@ -71,7 +71,7 @@ spec:
         - alert: APIDataStale
           expr: |
             api_data_freshness_seconds{job=~"zip|holidays|air-quality"} > 2592000
-          for: 5m
+          for: 30m
           labels:
             severity: warning
             team: api-company
@@ -79,6 +79,20 @@ spec:
             summary: "Stale dataset on {{ $labels.job }} ({{ $labels.dataset }})"
             description: "{{ $labels.job }} dataset '{{ $labels.dataset }}' has not been re-seeded in {{ $value | humanizeDuration }} (threshold: 30 days). Re-seed required."
 
+        # -------------------------------------------------------------------
+        # APIDataCriticallyStale — data freshness > 60 days
+        # -------------------------------------------------------------------
+        - alert: APIDataCriticallyStale
+          expr: |
+            api_data_freshness_seconds{job=~"zip|holidays|air-quality"} > 5184000
+          for: 1h
+          labels:
+            severity: critical
+            team: api-company
+          annotations:
+            summary: "API data is critically stale on {{ $labels.job }}"
+            description: "{{ $labels.job }} data has not been re-seeded in more than 60 days ({{ $value | humanizeDuration }})"
+
         # -------------------------------------------------------------------
         # APIDown — any API job absent for 2 min
         # -------------------------------------------------------------------