Fix 1Password Connect numeric log levels misclassified in Grafana (#287)

## Summary
- 1Password Connect uses non-standard numeric log levels (`1`=error, `2`=warn, `3`=info, `4`=debug, `5`=trace) per [1Password/connect#44](https://github.com/1Password/connect/issues/44)
- Alloy extracts the `level` JSON field as-is, so info-level health checks get `level="3"` in Loki
- Grafana expects string level labels — numeric values are unrecognized, causing misclassified log severity/coloring
- Adds a `stage.match` + `stage.template` in the Alloy pipeline scoped to `{namespace="1password"}` to normalize numeric levels to standard strings
- Other services are completely unaffected (scoped by namespace, not global)

## Deployment and Testing
- [ ] Sync alloy-k8s from branch: `argocd app set alloy-k8s --revision fix/onepassword-numeric-log-levels && argocd app sync alloy-k8s`
- [ ] Wait ~2 minutes for new logs to flow
- [ ] Verify level labels: `curl -sG "http://localhost:3100/loki/api/v1/label/level/values" --data-urlencode 'query={namespace="1password"}'` should show `"info"` and `"warn"` instead of `"3"` and `"2"`
- [ ] Check Grafana log panel for 1password namespace — logs should no longer appear as errors
- [ ] After merge: `argocd app set alloy-k8s --revision main && argocd app sync alloy-k8s`

Reviewed-on: #287

argocd/manifests/alloy-k8s/config.alloy

@@ -100,6 +100,18 @@ loki.process "pods" {
     values = ["__error__", "__error_details__"]
   }
 
+  // Normalize 1password-connect numeric log levels to strings (1=error..5=trace)
+  // Scoped to the 1password namespace so other services are unaffected.
+  // See: https://github.com/1Password/connect/issues/44
+  stage.match {
+    selector = "{namespace=\"1password\"}"
+
+    stage.template {
+      source   = "level"
+      template = "{{ if eq .Value \"1\" }}error{{ else if eq .Value \"2\" }}warn{{ else if eq .Value \"3\" }}info{{ else if eq .Value \"4\" }}debug{{ else if eq .Value \"5\" }}trace{{ else }}{{ .Value }}{{ end }}"
+    }
+  }
+
   // Extract labels from parsed JSON data
   stage.labels {
     values = {

argocd/manifests/alloy-ringtail/config.alloy

@@ -139,6 +139,18 @@ loki.process "pods" {
     values = ["__error__", "__error_details__"]
   }
 
+  // Normalize 1password-connect numeric log levels to strings (1=error..5=trace)
+  // Scoped to the 1password namespace so other services are unaffected.
+  // See: https://github.com/1Password/connect/issues/44
+  stage.match {
+    selector = "{namespace=\"1password\"}"
+
+    stage.template {
+      source   = "level"
+      template = "{{ if eq .Value \"1\" }}error{{ else if eq .Value \"2\" }}warn{{ else if eq .Value \"3\" }}info{{ else if eq .Value \"4\" }}debug{{ else if eq .Value \"5\" }}trace{{ else }}{{ .Value }}{{ end }}"
+    }
+  }
+
   // Extract labels from parsed JSON data
   stage.labels {
     values = {

docs/changelog.d/fix-onepassword-numeric-log-levels.bugfix.md

@@ -0,0 +1 @@
+Fix 1Password Connect logs showing as errors in Grafana by normalizing numeric log levels (1-5) to standard strings (error/warn/info/debug/trace) in the Alloy log processing pipeline.