[grampsweb] Align PVC resource to encrypted storage; imported state

## Context

Grampsweb stack had an empty Terraform state — 7 K8s resources (namespace,
PVC, service, deployment, ingress, ExternalSecret manifest, TLS secret)
existed in the cluster but weren't tracked. This blocked commit 7b248897
(ollama LLM env-var removal) from being applied because any apply would
attempt to re-create existing resources.

Additionally, the TF source declared a **grampsweb-data-proxmox** PVC on
**storage_class=proxmox-lvm**, while the cluster had **grampsweb-data-encrypted**
on **proxmox-lvm-encrypted** (1 Gi, bound). The deployment was referencing
the encrypted PVC. This divergence predated this change — the source was
simply out of date vs cluster reality.

## This change

Two things:

1. **Source alignment** (the only file diff):
   - Renames `kubernetes_persistent_volume_claim.data_proxmox` →
     `data_encrypted`, metadata.name to match cluster, storage class to
     `proxmox-lvm-encrypted`.
   - Updates the deployment volume `claim_name` reference accordingly.
   - Aligns with the newer project convention documented in
     `.claude/CLAUDE.md`: "Default for sensitive data is
     proxmox-lvm-encrypted" and "Convention: PVC names end in `-encrypted`".
   - No destroy/recreate: the PVC and deployment already use the encrypted
     PVC in the cluster; TF source now just describes reality.

2. **State imports** (out-of-band, via `scripts/tg import`, not in diff):
   - `kubernetes_namespace.grampsweb` <- `grampsweb`
   - `kubernetes_persistent_volume_claim.data_encrypted` <- `grampsweb/grampsweb-data-encrypted`
   - `kubernetes_service.grampsweb` <- `grampsweb/grampsweb`
   - `kubernetes_deployment.grampsweb` <- `grampsweb/grampsweb`
   - `module.ingress.kubernetes_ingress_v1.proxied-ingress` <- `grampsweb/family`
   - `module.tls_secret.kubernetes_secret.tls_secret` <- `grampsweb/tls-secret`
   - `kubernetes_manifest.external_secret` <- `apiVersion=external-secrets.io/v1beta1,kind=ExternalSecret,namespace=grampsweb,name=grampsweb-secrets`

## Apply result

`Apply complete! Resources: 0 added, 7 changed, 0 destroyed.`

In-place updates applied:
- Deployment: dropped `GRAMPSWEB_LLM_BASE_URL` + `GRAMPSWEB_LLM_MODEL` env
  vars (both containers) — realising the intent of commit 7b248897.
- Ingress: realigned Traefik middleware annotation + cleaned stale
  `uptime.viktorbarzin.me/external-monitor=false` annotation.
- TLS secret: removed Kyverno-generated labels (Kyverno's
  `sync-tls-secret` ClusterPolicy re-applies them on next reconcile —
  no functional impact; same pattern in 29 other stacks using
  `setup_tls_secret` module).
- Namespace, PVC, service: trivial metadata alignments (label /
  `wait_until_bound` / `wait_for_load_balancer`).
- `kubernetes_manifest.external_secret`: populated the `manifest`
  attribute after import (expected).

## What is NOT in this change

- No replica bump: deployment stays at `replicas=0` (stack is intentionally
  inactive per 2026-03-14 OOM incident note).
- No destroy/recreate of any resource.
- The broader code-w97 (11 stacks with empty state) is NOT closed — only
  grampsweb is imported. 10 stacks remain: beads-server, insta2spotify,
  isponsorblocktv, kyverno, meshcentral, pvc-autoresizer, shadowsocks,
  tor-proxy, travel_blog, + meshcentral PVC.

## Reproduce locally

```
KUBECONFIG=/home/wizard/code/config kubectl get all,ingress,pvc,externalsecret,secret -n grampsweb
# Deployment still replicas=0; PVC grampsweb-data-encrypted Bound; ingress 'family'
# on family.viktorbarzin.me; ExternalSecret SecretSynced True.

cd /home/wizard/code/infra/stacks/grampsweb
/home/wizard/code/infra/scripts/tg plan
# Expected: 'No changes.' (clean state after apply).
```

## Test Plan

### Automated
```
$ cd /home/wizard/code/infra/stacks/grampsweb && /home/wizard/code/infra/scripts/tg plan
Plan: 0 to add, 7 to change, 0 to destroy.  [pre-apply]

$ /home/wizard/code/infra/scripts/tg apply --non-interactive
Plan: 0 to add, 7 to change, 0 to destroy.
kubernetes_namespace.grampsweb: Modifications complete after 0s [id=grampsweb]
kubernetes_persistent_volume_claim.data_encrypted: Modifications complete after 0s [id=grampsweb/grampsweb-data-encrypted]
kubernetes_service.grampsweb: Modifications complete after 0s [id=grampsweb/grampsweb]
module.ingress.kubernetes_ingress_v1.proxied-ingress: Modifications complete after 0s [id=grampsweb/family]
module.tls_secret.kubernetes_secret.tls_secret: Modifications complete after 0s [id=grampsweb/tls-secret]
kubernetes_manifest.external_secret: Modifications complete after 0s
kubernetes_deployment.grampsweb: Modifications complete after 1s [id=grampsweb/grampsweb]
Apply complete! Resources: 0 added, 7 changed, 0 destroyed.

$ terraform fmt -check -recursive stacks/grampsweb
(no output - formatted clean)
```

### Manual Verification
```
$ KUBECONFIG=/home/wizard/code/config kubectl get all,ingress,pvc,externalsecret,secret -n grampsweb
# - deployment.apps/grampsweb 0/0 0 0 47d   (replicas=0 preserved)
# - service/grampsweb ClusterIP 10.106.232.205:80/TCP
# - persistentvolumeclaim/grampsweb-data-encrypted Bound pvc-c9a5dcf4... 1Gi RWO proxmox-lvm-encrypted
# - ingress/family traefik family.viktorbarzin.me -> 10.0.20.200:80,443
# - externalsecret/grampsweb-secrets vault-kv 15m SecretSynced True
# - secret/tls-secret kubernetes.io/tls
# No pod crashes (no pods — replicas=0).
```

Closes: code-8m6

stacks/grampsweb/main.tf

@@ -61,10 +61,10 @@ module "tls_secret" {
   tls_secret_name = var.tls_secret_name
 }
 
-resource "kubernetes_persistent_volume_claim" "data_proxmox" {
+resource "kubernetes_persistent_volume_claim" "data_encrypted" {
   wait_until_bound = false
   metadata {
-    name      = "grampsweb-data-proxmox"
+    name      = "grampsweb-data-encrypted"
     namespace = kubernetes_namespace.grampsweb.metadata[0].name
     annotations = {
       "resize.topolvm.io/threshold"     = "80%"
@@ -74,7 +74,7 @@ resource "kubernetes_persistent_volume_claim" "data_proxmox" {
   }
   spec {
     access_modes       = ["ReadWriteOnce"]
-    storage_class_name = "proxmox-lvm"
+    storage_class_name = "proxmox-lvm-encrypted"
     resources {
       requests = {
         storage = "1Gi"
@@ -316,7 +316,7 @@ resource "kubernetes_deployment" "grampsweb" {
         volume {
           name = "data"
           persistent_volume_claim {
-            claim_name = kubernetes_persistent_volume_claim.data_proxmox.metadata[0].name
+            claim_name = kubernetes_persistent_volume_claim.data_encrypted.metadata[0].name
           }
         }
       }