DEPOT logging: add Telemt fleet monitoring via Zabbix

Install and persist Grafana Zabbix plugin 6.5.0, provision the internal Zabbix datasource, and add a fleet dashboard modeled on client 02 Telemt panels.

Add an active-agent Zabbix 7 template plus a 30-second sanitized collector for active IP count/list, connections, traffic, and uptime. Active checks avoid inbound polling of client-private Docker hosts.

The exact Zabbix host names and required ZABBIX_API_TOKEN Portainer variable are documented. Compose validation passed on 10.0.0.6; the live plugin registered successfully under Grafana 13.1.0.

logging/alloy-config.alloy

@@ -1,7 +1,9 @@
-// Direct replacement for the old syslog-ng -> Promtail -> Loki path.
+// Replaces Promtail in the old syslog-ng -> Promtail -> Loki path.
 //
-// Existing RouterOS senders target 185.108.4.158:514/udp and use classic
-// BSD/RFC3164 framing. TCP/601 is retained for RFC5424-capable senders.
+// DEPOT's fleet is not uniformly parseable as RFC3164: some RouterOS senders
+// emit raw messages without a PRI/header. syslog-ng therefore keeps listening
+// on the public stack ports and normalizes every message to RFC5424 before
+// forwarding it here on the private stack network.
 
 loki.relabel "syslog" {
   forward_to = []
@@ -28,29 +30,14 @@ loki.relabel "syslog" {
   }
 }
 
-loki.source.syslog "network_devices_udp" {
+loki.source.syslog "normalized_syslog" {
   listener {
-    address       = "0.0.0.0:514"
-    protocol      = "udp"
-    syslog_format = "rfc3164"
-    labels = {
-      job       = "syslog",
-      transport = "udp",
-    }
-  }
-
-  relabel_rules = loki.relabel.syslog.rules
-  forward_to    = [loki.write.default.receiver]
-}
-
-loki.source.syslog "network_devices_tcp" {
-  listener {
-    address       = "0.0.0.0:601"
+    address       = "0.0.0.0:1514"
     protocol      = "tcp"
     syslog_format = "rfc5424"
     labels = {
       job       = "syslog",
-      transport = "tcp",
+      transport = "syslog-ng",
     }
   }