fix: resolve staging deployment issues with Traefik, Loki, and Alloy (refs #105)

- Exclude blue-green.yml from staging Traefik by mounting dynamic-staging/
  directory (only grafana.yml + middleware.yml) instead of dynamic/ which
  contains production-only blue-green routing config
- Disable Loki healthcheck: distroless image has no /bin/sh so CMD-SHELL
  healthchecks cannot execute; Alloy and Grafana verify Loki connectivity
- Fix Alloy healthcheck: replace wget (not in image) with bash /dev/tcp
- Add Grafana staging domain override (logs.staging.motovaultpro.com)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docker-compose.staging.yml

@@ -15,6 +15,8 @@ services:
   mvp-traefik:
     image: ${REGISTRY_MIRRORS:-git.motovaultpro.com/egullickson/mirrors}/traefik:v3.6
     container_name: mvp-traefik-staging
+    volumes:
+      - ./config/traefik/dynamic-staging:/etc/traefik/dynamic:ro
     labels:
       - "traefik.http.routers.traefik-dashboard.rule=Host(`traefik.staging.motovaultpro.com`)"
 
@@ -79,6 +81,20 @@ services:
     volumes:
       - mvp_redis_staging_data:/data
 
+  # ========================================
+  # Grafana (Staging domain override)
+  # ========================================
+  mvp-grafana:
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=motovaultpro_frontend"
+      - "traefik.http.routers.grafana.rule=Host(`logs.staging.motovaultpro.com`)"
+      - "traefik.http.routers.grafana.entrypoints=websecure"
+      - "traefik.http.routers.grafana.tls=true"
+      - "traefik.http.routers.grafana.tls.certresolver=letsencrypt"
+      - "traefik.http.routers.grafana.middlewares=grafana-ipwhitelist@file"
+      - "traefik.http.services.grafana.loadbalancer.server.port=3000"
+
 # Staging-specific volumes (separate from production)
 volumes:
   mvp_postgres_staging_data: