feat: add ServiceMonitors and enable metrics scraping

- SeaweedFS: enable -metricsPort=9091 on master/volume/filer, add
  service labels, create ServiceMonitor
- Gitea: enable metrics in config, create ServiceMonitor
- Hydra/Kratos: standalone ServiceMonitors (chart templates require
  .Capabilities.APIVersions unavailable in kustomize helm template)
- LiveKit: add prometheus_port=6789, standalone ServiceMonitor
  (disabled in kustomization — host firewall blocks port 6789)
- OpenSearch: revert prometheus-exporter attempt (no plugin for v3.x),
  add service label for future exporter sidecar

base/ory/hydra-servicemonitor.yaml

@@ -0,0 +1,16 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: hydra
+  namespace: ory
+  labels:
+    release: kube-prometheus-stack
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: hydra
+      app.kubernetes.io/component: admin
+  endpoints:
+    - port: http
+      interval: 30s
+      path: /admin/metrics/prometheus

base/ory/hydra-values.yaml

@@ -47,6 +47,10 @@ hydra-maester:
     - lasuite
     - matrix
 
+# ServiceMonitor created as standalone resource (hydra-servicemonitor.yaml) —
+# chart's built-in ServiceMonitor requires .Capabilities.APIVersions which
+# kustomize helm template doesn't provide.
+
 deployment:
   extraEnv:
     - name: DSN

base/ory/kratos-servicemonitor.yaml

@@ -0,0 +1,16 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: kratos
+  namespace: ory
+  labels:
+    release: kube-prometheus-stack
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: kratos
+      app.kubernetes.io/component: admin
+  endpoints:
+    - port: http
+      interval: 30s
+      path: /admin/metrics/prometheus

base/ory/kratos-values.yaml

@@ -106,6 +106,10 @@ secret:
   enabled: false
   nameOverride: kratos-app-secrets
 
+# ServiceMonitor created as standalone resource (kratos-servicemonitor.yaml) —
+# chart's built-in ServiceMonitor requires .Capabilities.APIVersions which
+# kustomize helm template doesn't provide.
+
 deployment:
   extraEnv:
     - name: DSN