feat: central/shared kubernetes platform landing zone and optional namespace creation in app landing zone

[lweberru]

Summary

This PR adds a complete Landing Zone namespace service demo flow with real observability integration and Grafana dashboard provisioning.

Included

• Adds platform-kubernetes module wiring and outputs
• Adds namespace service demo resources and dashboard definition/import workflow
• Adds observability outputs and credentials wiring for Grafana/metrics push
• Adds required provider updates (null) and root/module variable/output wiring

Validation

• tofu validate (success, with deprecation warnings from provider attributes)

Issue References

Closes #35
Closes #36

Out of Scope

• SNA Kubernetes follow-up is intentionally not completed in this PR.
• Tracking remains in Feature: Private/SNA SKE cluster support with two-stage runner model #37.

[mahauber]

this doesnt make sense to me

[lweberru]

All review points were addressed in code. The only non-finalized platform capability is provider-native extensions.dns.gatewayApi; until available, we use a Terraform-managed DNS record-set bridge (stackit_dns_record_set) documented in Issue 41.