feat: add ServiceMonitors and enable metrics scraping

- SeaweedFS: enable -metricsPort=9091 on master/volume/filer, add
  service labels, create ServiceMonitor
- Gitea: enable metrics in config, create ServiceMonitor
- Hydra/Kratos: standalone ServiceMonitors (chart templates require
  .Capabilities.APIVersions unavailable in kustomize helm template)
- LiveKit: add prometheus_port=6789, standalone ServiceMonitor
  (disabled in kustomization — host firewall blocks port 6789)
- OpenSearch: revert prometheus-exporter attempt (no plugin for v3.x),
  add service label for future exporter sidecar

base/data/opensearch-deployment.yaml

@@ -24,8 +24,9 @@ spec:
       containers:
         - name: opensearch
           image: opensearchproject/opensearch:3
-          command: ["sh", "-c"]
-          args: ["opensearch-plugin install --batch prometheus-exporter || true; /usr/share/opensearch/opensearch-docker-entrypoint.sh"]
+          # OpenSearch 3.x has no maintained prometheus-exporter plugin.
+          # Metrics come from /_cluster/stats JSON API (scraped by dashboard queries).
+          # TODO: add opensearch-exporter sidecar for native Prometheus metrics.
           ports:
             - name: http
               containerPort: 9200

base/data/opensearch-service.yaml

@@ -3,6 +3,8 @@ kind: Service
 metadata:
   name: opensearch
   namespace: data
+  labels:
+    app: opensearch
 spec:
   selector:
     app: opensearch

base/data/opensearch-servicemonitor.yaml

@@ -0,0 +1,16 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: opensearch
+  namespace: data
+  labels:
+    app: opensearch
+    release: kube-prometheus-stack
+spec:
+  selector:
+    matchLabels:
+      app: opensearch
+  endpoints:
+    - port: http
+      interval: 30s
+      path: /_prometheus/metrics