feat: Expose Grafana, Prometheus, and Flux UI via Tailscale LoadBalancer services

Replace Ansible port-forwarding + tailscale serve with direct Tailscale LB
services matching the existing Rancher pattern. Each service gets its own
tailnet hostname (grafana/prometheus/flux.silverside-gopher.ts.net).

infrastructure/addons/kustomization-observability.yaml

@@ -12,6 +12,8 @@ spec:
   path: ./infrastructure/addons/observability
   dependsOn:
     - name: addon-external-secrets
+    - name: addon-tailscale-operator
+    - name: addon-tailscale-proxyclass
   wait: true
   timeout: 5m
   suspend: false