vmagent: set consul datacenter to avoid agent:read requirement

The consul SD discovered 0 targets: VictoriaMetrics queried
/v1/agent/self to auto-detect the datacenter, which needs agent:read that
the anonymous consul token lacks (catalog/health reads work anonymously).
Set datacenter: au-syd1 explicitly so the agent/self call is skipped.

apps/base/observability/vmagent.yaml

@@ -99,6 +99,10 @@ spec:
       consul_sd_configs:
         - server: consul.service.consul:443
           scheme: https
+          # Set datacenter explicitly so VM does not call /v1/agent/self
+          # (which needs agent:read that the anonymous token lacks); catalog
+          # and health reads work anonymously.
+          datacenter: au-syd1
           tls_config:
             ca_file: /etc/vmagent-tls/ca.crt
       relabel_configs: