monitoring: keep Loki chunks in S3, 90 days of logs and metrics

ops has 12 GB free on a 38 GB disk and the Traefik access log alone
is ~600 MB, so logs can't grow there. From 2026-11-14 Loki writes
chunks and index to Hetzner Object Storage (asxpio-loki-main, hel1)
with the existing project key, passed through loki.env and
-config.expand-env. Today's filesystem period ages out by retention.

Log retention goes from 14 to 90 days. Prometheus metrics are small
(~20 MB so far) and stay local, now for 90 days instead of 30.

Assisted-by: Claude:opus-5-5

ansible/roles/monitoring/templates/loki.yml.j2

@@ -22,6 +22,22 @@ schema_config:
       index:
         prefix: index_
         period: 24h
+    # From here on chunks and index live in Hetzner Object Storage, not on
+    # ops' small disk. The filesystem period above ages out with retention.
+    - from: "2026-11-14"
+      store: tsdb
+      object_store: aws
+      schema: v13
+      index:
+        prefix: index_
+        period: 24h
+storage_config:
+  aws:
+    endpoint: {{ s3_region }}.your-objectstorage.com
+    region: {{ s3_region }}
+    bucketnames: {{ s3_bucket_loki }}
+    access_key_id: ${S3_ACCESS_KEY}
+    secret_access_key: ${S3_SECRET_KEY}
 limits_config:
   retention_period: {{ monitoring_logs_retention }}
   reject_old_samples: true
@@ -32,6 +48,6 @@ limits_config:
 compactor:
   working_directory: /loki/compactor
   retention_enabled: true
-  delete_request_store: filesystem
+  delete_request_store: aws
 analytics:
   reporting_enabled: false