…tart charts

Expands inline Prometheus surface on resource detail pages without trying to
become a Grafana replacement. Five additions, each hidden silently when its
data source isn't present (no nag, no "no data" messages).

* Request/limit dashed reference lines on existing CPU + memory area charts,
  summed across runtime containers (excluding pure init, including native
  sidecars) × readyReplicas for replicated workloads.
* Rightsizing strip on Deployment/StatefulSet/DaemonSet full-screen Metrics
  tab. P95 over 24h with KRR-style headroom (15% CPU, 10% memory). Tone
  policy is mild: 2-3x headroom reads as "well-sized", only >5x mem or >8x
  CPU surfaces as info "could reduce". Red reserved for actual OOM risk
  (memory P95 >= 95% of limit); orange only for confirmed CPU throttling.
* HPA detail page gets a replicas chart (current/desired lines + min/max
  reference lines) via KSM.
* PVC renderer gets a single-line usage gauge via kubelet_volume_stats_*.
  Hidden silently when the CSI driver doesn't report or Prom isn't scraping
  kubelet (notably GMP default).
* Restart event lane below the Metrics chart — vertical markers on a
  dedicated row rather than overlaying the waveform, so clusters of restarts
  stay readable.

Brittleness mitigations: every new feature gates on a query that returns no
series when its dependency (KSM, kubelet scrape, CSI NodeGetVolumeStats) is
missing, and hides rather than rendering an error or "not configured" panel.
PrometheusCharts' existing empty state still surfaces the "Discover
Prometheus" CTA when nothing is connected.

Adds `HPARenderer` and `PVCRenderer` to RendererOverrides so the host can
wrap them with platform data hooks without modifying the base renderers'
core layout.

* Reference line scale: PromQL is per-pod, drop the readyReplicas multiplier
  so the line lands on the same axis as the chart's per-pod series.
* RightsizingResponse.Rows: initialize as []RightsizingRow{} in the no-
  containers branch so the wire format matches the TS contract (non-null).
* loadWorkloadContainers: return sentinel errors so the handler can map
  cache-not-ready to 503 and RBAC-denied (nil lister) to 403 instead of
  reporting both as 404.
* PVC usage handler: log Prom query failures via errorlog so operators
  can distinguish "Prom unhealthy" from "CSI doesn't report".
* RBAC gate: new SetAuthGate hook in the prometheus package; server wires
  it to canRead. The new rightsizing + PVC endpoints now require the
  caller to be able to "get" the underlying resource before reading from
  the SA-populated informer cache.
* Restart event lane: emit a marker only when the rolling-window count
  increases (or first-sample-nonzero). The previous "every positive
  sample" rule turned one restart into ~60 markers + a ~60× total.
* readQuantity: NaN guards on the suffix paths so malformed YAML can't
  poison the request/limit sum.
* HPACharts + RestartEventLane: consume the React Query error field so
  Prom-side failures get a console.warn breadcrumb instead of silently
  looking identical to no-data.
* PVCUsageBar: paired light/dark text tones (text-red-700 / text-red-400)
  so the percentage stays legible in both themes.
* Comment drift: "Pods are too granular" reworded to match the gate;
  PVC label-fallback comment trimmed to match what the code actually does.
* Add rightsizing_test.go: tone-classifier boundaries (3x/5x/8x ratios,
  0.95 mem-OOM threshold), recommendRequest 10m/16Mi rounding, native-
  sidecar inclusion, formatRightsizingValue edge cases.