monitoring: fix openbao token refresh timer not triggering

RemainAfterExit=true kept the service in "active" state, which
prevented OnUnitActiveSec from scheduling new triggers since there
was no new "activation" event. Removing it allows the service to
properly go inactive, enabling the timer to reschedule correctly.

Also fix ExecStart to use lib.getExe for proper path resolution
with writeShellApplication.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

services/monitoring/prometheus.nix

@@ -58,8 +58,7 @@ in
 
     serviceConfig = {
       Type = "oneshot";
-      ExecStart = fetchOpenbaoToken;
+      ExecStart = lib.getExe fetchOpenbaoToken;
-      RemainAfterExit = true;
     };
   };