feat: add ServiceMonitors and enable metrics scraping

- SeaweedFS: enable -metricsPort=9091 on master/volume/filer, add
  service labels, create ServiceMonitor
- Gitea: enable metrics in config, create ServiceMonitor
- Hydra/Kratos: standalone ServiceMonitors (chart templates require
  .Capabilities.APIVersions unavailable in kustomize helm template)
- LiveKit: add prometheus_port=6789, standalone ServiceMonitor
  (disabled in kustomization — host firewall blocks port 6789)
- OpenSearch: revert prometheus-exporter attempt (no plugin for v3.x),
  add service label for future exporter sidecar

base/media/livekit-servicemonitor.yaml

@@ -0,0 +1,15 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: livekit
+  namespace: media
+  labels:
+    release: kube-prometheus-stack
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: livekit-server
+  endpoints:
+    - port: metrics
+      interval: 30s
+      path: /

base/media/livekit-values.yaml

@@ -7,6 +7,7 @@ livekit:
   # LiveKit server config injected as config.yaml
   port: 7880
   log_level: info
+  prometheus_port: 6789
 
   rtc:
     port_range_start: 49152
@@ -34,6 +35,9 @@ storeKeysInSecret:
   enabled: true
   existingSecret: livekit-api-credentials
 
+# ServiceMonitor created as standalone resource (livekit-servicemonitor.yaml) —
+# chart template requires livekit.prometheus_port which conflicts with hostNetwork.
+
 deployment:
   # hostNetwork gives LiveKit direct access to the host network namespace,
   # which is the only practical way to expose the 10k-port TURN relay range