refs: team#41655

refs: team#41655

I did the onboarding with gillian and things were not quite right. The
top NOTE was particularly confusing.

This has become a blocker for other teams to manage their buckets and
ACLs. I had created an account for hiro to manage her stuff, but it
blocked on her lacking access to the server to jump to the admin
interface (team#41873).

So widen access here: allow all admins to access the admin interface
directly (same as global SSH access), then also allow the jump hosts,
and provide a shim (in hiera) to add extra IP addresses just for
MinIO (currently unused).

@lelutin got confused by the admin/gitlab string, this should make it clearer.

firefox doesn't place the downloaded screenshots where I thought it
would. I should have looked at the content before sending.

This adds this information in each client configuration section that the
email password is different than the one used for logging in to db.tpo.
Hopefully it'll help more people better understand the procedure.

This should help ppl better locate the field. There is often confusion
between the `Change Password` and `Change mail password` fields.

I *think* the problem was the lists weren't indented, but whatever,
this works.

see tpo/tpa/team#42002

We stop short of rewriting all playbooks for Prometheus, and instead
add references to the task of adding playbooks for
everything (prometheus-alerts#16) where we found references to
nagios.

It took me a while to reach that today.