monitoring: fix openbao token output path

The outputDir with extractKey should be the full file path, not just
the parent directory.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

services/monitoring/prometheus.nix

@@ -11,7 +11,7 @@ in
   vault.secrets.openbao-token = {
     secretPath = "hosts/monitoring01/openbao-token";
     extractKey = "token";
-    outputDir = "/run/secrets/prometheus";
+    outputDir = "/run/secrets/prometheus/openbao-token";
     mode = "0400";
     owner = "prometheus";
     services = [ "prometheus" ];