fix: Correct pod selectors for Prometheus and Flux Tailscale services, use Doppler for Grafana creds

Prometheus needs operator.prometheus.io/name label selector. Flux UI pods
are labeled gitops-server not weave-gitops. Grafana now reads admin creds
from Doppler via ExternalSecret instead of hardcoded values.

infrastructure/addons/observability/prometheus-tailscale-service.yaml

@@ -11,6 +11,7 @@ spec:
   loadBalancerClass: tailscale
   selector:
     app.kubernetes.io/name: prometheus
+    operator.prometheus.io/name: observability-kube-prometh-prometheus
   ports:
     - name: http
       port: 9090