Fix prometheus secret namespace and frigate capabilities

- Revert talos-client-cert secret to prometheus namespace (prometheus
  pods mount this secret, not kube-system pods)
- Add CHOWN/DAC_OVERRIDE/SETUID/SETGID capabilities to frigate
  (s6-overlay needs chown for log directories)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/frigate/values.yaml

@@ -154,6 +154,11 @@ tmpfs:
 securityContext:
   privileged: false
   capabilities:
+    add:
+      - CHOWN
+      - DAC_OVERRIDE
+      - SETUID
+      - SETGID
     drop:
       - ALL