Render SILO observability configuration as first-class MINIO role settings

Parent: #763

Problem

SILO observability currently depends on a few implicit values in minio.env plus the global VictoriaMetrics scrape template. Operators can add arbitrary minio_extra_vars, but that is not a clear or testable module contract for the embedded Console, Metrics V3, bucket metrics, TLS, and Pigsty topology labels.

Scope

Add first-class role rendering for the SILO monitoring contract:

• Prometheus/VictoriaMetrics URL;
• Console job selector;
• Console extra-label selector;
• metrics authentication mode;
• V3 root endpoint and configured-bucket endpoint metadata;
• HTTP/TLS settings inherited from the MINIO cluster definition;
• stable Pigsty identity labels such as cls, ins, ip, and flavor.

The role should derive safe defaults from inventory topology while retaining explicit overrides for external monitoring deployments. Arbitrary extra server environment variables may remain an escape hatch, but normal SILO observability must not require them.

This issue owns the rendering mechanism and variable contract. The cluster-filter policy, V3 scrape topology, and consumer query migration are tracked separately under the epic.

Implementation notes

• Render server-side MINIO_PROMETHEUS_* variables for the embedded Console.
• Document the corresponding CONSOLE_PROMETHEUS_* names for a separately deployed Console.
• Quote/escape selector values so cluster names cannot produce invalid PromQL matchers.
• Do not render credentials into file-SD labels or other Prometheus time-series labels.
• Preserve existing external VictoriaMetrics and disabled-monitoring use cases.

Acceptance criteria

• Defaults render a working SILO-to-VictoriaMetrics-to-Console path with no raw minio_extra_vars.
• Operators can override the metrics URL and disable or externally manage monitoring.
• HTTP and TLS deployments render the correct scheme and TLS behavior.
• Generated environment and file-SD files are deterministic, pass check mode, and are idempotent.
• Variable semantics and examples are documented.

Start with the existing minio.env rendering, minio_extra_vars handling, and the global VictoriaMetrics scrape template mentioned in the issue. Trace how generated environment and file-SD files are produced and checked, then verify deterministic, idempotent output for default, HTTP/TLS, external-monitoring, and disabled-monitoring cases without credentials in labels.