fix(grafana): wire orphan status-onion-service.yaml into kustomization (#30)

`workloads/grafana/status-onion-service.yaml` defines an OnionService
for the public status dashboard but wasn't referenced from
`workloads/grafana/kustomization.yaml`, so it was never applied. The
matching tor private key (`status-tor-proxy-key` Secret) IS in the
cluster — just unused. Adding the resource entry deploys the
OnionService, which derives
`7m3fv4pd5m3n24vqttmjr7x473apso2s6pfjmslildkxa5rctfikyqid.onion` from
that key.

After merge: `kubectl get onionservice -n grafana` should list `status`
alongside `grafana`.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Author: xnoto

workloads/grafana/kustomization.yaml

@@ -9,6 +9,7 @@ resources:
   - status-datasource.yaml
   - status-dashboard.yaml
   - onion-service.yaml
+  - status-onion-service.yaml
   - tunnel-binding.yaml
 generators:
   - ksops-grafana-secrets.yaml