fix: Correct pod selectors for Prometheus and Flux Tailscale services, use Doppler for Grafana creds

Prometheus needs operator.prometheus.io/name label selector. Flux UI pods
are labeled gitops-server not weave-gitops. Grafana now reads admin creds
from Doppler via ExternalSecret instead of hardcoded values.

infrastructure/addons/observability/helmrelease-kube-prometheus-stack.yaml

@@ -25,8 +25,7 @@ spec:
     grafana:
       enabled: true
       admin:
-        user: admin
-        password: admin123
+        existingSecret: grafana-admin-credentials
       grafana.ini:
         server:
           root_url: http://grafana.silverside-gopher.ts.net/