fix: Align Prometheus external URL with Tailscale service port

Prometheus is exposed on port 9090 through the Tailscale LoadBalancer
service, so the configured external URL and repo docs should match the
actual address users reach after rebuilds.

AGENTS.md

@@ -18,7 +18,7 @@ Repository guide for agentic contributors working in this repo.
 - **cert-manager** is required — Tailscale LoadBalancer does L4 TCP passthrough, so Rancher serves its own TLS.
 - **Secrets flow**: Doppler → `ClusterSecretStore` (doppler-hetznerterra) → `ExternalSecret` resources → k8s Secrets.
 - Rancher is reachable only over Tailscale at `https://rancher.silverside-gopher.ts.net/`.
-- Grafana, Prometheus, and Flux UI are also exposed via dedicated Tailscale LoadBalancer services at `http://grafana.silverside-gopher.ts.net/`, `http://prometheus.silverside-gopher.ts.net/`, `http://flux.silverside-gopher.ts.net:9001/`.
+- Grafana, Prometheus, and Flux UI are also exposed via dedicated Tailscale LoadBalancer services at `http://grafana.silverside-gopher.ts.net/`, `http://prometheus.silverside-gopher.ts.net:9090/`, `http://flux.silverside-gopher.ts.net:9001/`.
 
 ## Important Files
 

infrastructure/addons/observability/helmrelease-kube-prometheus-stack.yaml

@@ -49,7 +49,7 @@ spec:
       service:
         type: ClusterIP
       prometheusSpec:
-        externalUrl: http://prometheus.silverside-gopher.ts.net/
+        externalUrl: http://prometheus.silverside-gopher.ts.net:9090/
         routePrefix: /
         retention: 7d
         storageSpec: