monitoring: keep Loki chunks in S3, 90 days of logs and metrics

ops has 12 GB free on a 38 GB disk and the Traefik access log alone
is ~600 MB, so logs can't grow there. From 2026-11-14 Loki writes
chunks and index to Hetzner Object Storage (asxpio-loki-main, hel1)
with the existing project key, passed through loki.env and
-config.expand-env. Today's filesystem period ages out by retention.

Log retention goes from 14 to 90 days. Prometheus metrics are small
(~20 MB so far) and stay local, now for 90 days instead of 30.

Assisted-by: Claude:opus-5-5

ansible/roles/monitoring/templates/docker-compose.yml.j2

@@ -18,7 +18,9 @@ services:
   loki:
     image: grafana/loki:{{ monitoring_loki_version }}
     container_name: loki
-    command: ["-config.file=/etc/loki/loki.yml"]
+    # S3 keys come from loki.env, expanded into the config at start
+    command: ["-config.file=/etc/loki/loki.yml", "-config.expand-env=true"]
+    env_file: [loki.env]
     ports:
       # Alloy on both hosts pushes here over the VPC
       - "{{ asxpio_ops_vpc_ip }}:{{ monitoring_loki_port }}:3100"