feat: add optional basic auth support for Loki client

Some Loki deployments (e.g., behind a reverse proxy or Grafana Cloud)
require HTTP Basic Authentication. This adds optional --loki-username
and --loki-password flags (and corresponding env vars) to the
lab-monitoring server, along with NixOS module options for secure
credential management via systemd LoadCredential.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/monitoring/handlers_test.go

@@ -31,7 +31,7 @@ func setupTestServer(t *testing.T, promHandler, amHandler http.HandlerFunc, loki
 	var lokiSrv *httptest.Server
 	if len(lokiHandler) > 0 && lokiHandler[0] != nil {
 		lokiSrv = httptest.NewServer(lokiHandler[0])
-		loki = NewLokiClient(lokiSrv.URL)
+		loki = NewLokiClient(LokiClientOptions{BaseURL: lokiSrv.URL})
 	}
 
 	RegisterHandlers(server, prom, am, loki, HandlerOptions{EnableSilences: true})