feat: Expose Grafana, Prometheus, and Flux UI via Tailscale LoadBalancer services

Replace Ansible port-forwarding + tailscale serve with direct Tailscale LB
services matching the existing Rancher pattern. Each service gets its own
tailnet hostname (grafana/prometheus/flux.silverside-gopher.ts.net).

infrastructure/addons/observability/kustomization.yaml

@@ -2,12 +2,10 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - namespace.yaml
-  # - grafana-admin-externalsecret.yaml  # Using static password for stable baseline
-  # - traefik-tailscale-service.yaml  # Deferred - complex dependency on tailscale operator
-  # - grafana-ingress.yaml  # Deferred - requires tailscale service
-  # - prometheus-ingress.yaml  # Deferred - requires tailscale service
   - helmrepository-prometheus-community.yaml
   - helmrepository-grafana.yaml
   - helmrelease-kube-prometheus-stack.yaml
   - helmrelease-loki.yaml
   - helmrelease-promtail.yaml
+  - grafana-tailscale-service.yaml
+  - prometheus-tailscale-service.yaml