feat: switch to NGINX ingress to expose Grafana on same IP

- Restore ingressClassName: nginx and /grafana path in ingress.yaml
  (GCE ingress does not support ExternalName backends needed for
  cross-namespace Grafana routing)
- Install ingress-nginx via Helm in deploy-gke before applying
  manifests; --wait ensures the LoadBalancer IP is ready before
  the Ingress is created

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>