feat: add ServiceMonitors and enable metrics scraping

- SeaweedFS: enable -metricsPort=9091 on master/volume/filer, add
  service labels, create ServiceMonitor
- Gitea: enable metrics in config, create ServiceMonitor
- Hydra/Kratos: standalone ServiceMonitors (chart templates require
  .Capabilities.APIVersions unavailable in kustomize helm template)
- LiveKit: add prometheus_port=6789, standalone ServiceMonitor
  (disabled in kustomization — host firewall blocks port 6789)
- OpenSearch: revert prometheus-exporter attempt (no plugin for v3.x),
  add service label for future exporter sidecar

base/devtools/gitea-servicemonitor.yaml

@@ -0,0 +1,16 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: gitea
+  namespace: devtools
+  labels:
+    app: gitea
+    release: kube-prometheus-stack
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: gitea
+  endpoints:
+    - port: http
+      interval: 30s
+      path: /metrics

base/devtools/gitea-values.yaml

@@ -69,6 +69,10 @@ gitea:
       MINIO_USE_SSL:  "false"
       # MINIO_ACCESS_KEY_ID / MINIO_SECRET_ACCESS_KEY from gitea-s3-credentials Secret
 
+    metrics:
+      ENABLED: "true"
+      TOKEN: ""
+
   additionalConfigFromEnvs:
     - name: GITEA__DATABASE__PASSWD
       valueFrom: