fix: use Kratos session auth for observability endpoints

Observability routes (systemmetrics, systemlogs, systemtracing) use
Kratos /sessions/whoami for auth_request — validates browser session
cookies scoped to the parent domain. Admin API routes (id, hydra,
search, vault) keep Hydra /userinfo for Bearer token auth (CLI access).

base/ingress/pingora-config.yaml

@@ -230,7 +230,7 @@ data:
       [[routes.paths]]
       prefix       = "/"
       backend      = "http://kube-prometheus-stack-prometheus.monitoring.svc.cluster.local:9090"
-      auth_request = "http://hydra-public.ory.svc.cluster.local:4444/userinfo"
+      auth_request = "http://kratos-public.ory.svc.cluster.local/sessions/whoami"
 
     [[routes]]
     host_prefix = "systemlogs"
@@ -239,7 +239,7 @@ data:
       [[routes.paths]]
       prefix       = "/"
       backend      = "http://loki-gateway.monitoring.svc.cluster.local:80"
-      auth_request = "http://hydra-public.ory.svc.cluster.local:4444/userinfo"
+      auth_request = "http://kratos-public.ory.svc.cluster.local/sessions/whoami"
 
     [[routes]]
     host_prefix = "systemtracing"
@@ -248,7 +248,7 @@ data:
       [[routes.paths]]
       prefix       = "/"
       backend      = "http://tempo.monitoring.svc.cluster.local:3200"
-      auth_request = "http://hydra-public.ory.svc.cluster.local:4444/userinfo"
+      auth_request = "http://kratos-public.ory.svc.cluster.local/sessions/whoami"
 
     [[routes]]
     host_prefix = "livekit"