feat: Expose Grafana, Prometheus, and Flux UI via Tailscale LoadBalancer services

Replace Ansible port-forwarding + tailscale serve with direct Tailscale LB
services matching the existing Rancher pattern. Each service gets its own
tailnet hostname (grafana/prometheus/flux.silverside-gopher.ts.net).

infrastructure/addons/observability/helmrelease-kube-prometheus-stack.yaml

@@ -29,8 +29,8 @@ spec:
         password: admin123
       grafana.ini:
         server:
-          root_url: http://observability/grafana/
-          serve_from_sub_path: true
+          root_url: http://grafana.silverside-gopher.ts.net/
+          serve_from_sub_path: false
       persistence:
         enabled: true
         storageClassName: local-path
@@ -50,8 +50,8 @@ spec:
       service:
         type: ClusterIP
       prometheusSpec:
-        externalUrl: http://observability/prometheus/
-        routePrefix: /prometheus/
+        externalUrl: http://prometheus.silverside-gopher.ts.net/
+        routePrefix: /
         retention: 7d
         storageSpec:
           volumeClaimTemplate: