Fix prometheus secret namespace and frigate capabilities

- Revert talos-client-cert secret to prometheus namespace (prometheus
  pods mount this secret, not kube-system pods)
- Add CHOWN/DAC_OVERRIDE/SETUID/SETGID capabilities to frigate
  (s6-overlay needs chown for log directories)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/frigate/values.yaml

@@ -154,6 +154,11 @@ tmpfs:
 securityContext:
   privileged: false
   capabilities:
+    add:
+      - CHOWN
+      - DAC_OVERRIDE
+      - SETUID
+      - SETGID
     drop:
       - ALL
 

infrastructure/prometheus/manifests/talos-client-cert-secret.yaml

@@ -2,7 +2,7 @@ apiVersion: v1
 kind: Secret
 metadata:
   name: talos-client-cert
-  namespace: kube-system
+  namespace: prometheus
 type: Opaque
 data:
   ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQekNCOHFBREFnRUNBaEVBelVmaHJ2MW5uS21DcHVLTW90MUhOakFGQmdNclpYQXdFREVPTUF3R0ExVUUKQ2hNRmRHRnNiM013SGhjTk1qVXhNVE13TVRrME56UXlXaGNOTXpVeE1USTRNVGswTnpReVdqQVFNUTR3REFZRApWUVFLRXdWMFlXeHZjekFxTUFVR0F5dGxjQU1oQUpWWThDUDAyN0ZQWnJONzJPMlZkaGRCYjY3Z0plaUFINloxClNlUDAvWFlBbzJFd1h6QU9CZ05WSFE4QkFmOEVCQU1DQW9Rd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUcKQ0NzR0FRVUZCd01DTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRk1zbmNVTVo4ZGZhVlR3Ugo3RVVZNEl1TjZCZEJNQVVHQXl0bGNBTkJBTjlkK2laekxVdjJXQXNxNWdPbDh2bmhzSHhRMXY3SU1zOGtEZFNHClNUTVZSa1hvTzNKZmdqNUZ4QUMrN2JmV3hGZytzdW9rU3dWdWVBZ1VJTzFrUXdFPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==