refactor(kubevirt-youko): resolve cert paths with relativeToRoot

The service modules moved two levels deeper, so their certs/ paths
resolved relative to the wrong directory. Use mylib.relativeToRoot so
they no longer depend on the module's depth.

hosts/k8s/kubevirt-youko/homelab-services/caddy.nix

@@ -1,4 +1,5 @@
 {
+  mylib,
   pkgs,
   config,
   wallpapers,
@@ -7,7 +8,9 @@
 let
   hostCommonConfig = ''
     encode zstd gzip
-    tls ${../../certs/ecc-server.crt} ${config.age.secrets."caddy-ecc-server.key".path} {
+    tls ${mylib.relativeToRoot "certs/ecc-server.crt"} ${
+      config.age.secrets."caddy-ecc-server.key".path
+    } {
       protocols tls1.3 tls1.3
       curves x25519 secp384r1 secp521r1
     }

hosts/k8s/kubevirt-youko/homelab-services/grafana/datasources.nix

@@ -1,4 +1,4 @@
-{ config, ... }:
+{ config, mylib, ... }:
 {
 
   # Declaratively provision Grafana's data sources, dashboards, and alerting rules.
@@ -114,7 +114,7 @@
             postgresVersion = 1500; # 15.xx
             # tls
             tlsConfigurationMethod = "file-path";
-            sslRootCertFile = ../../../certs/ecc-ca.crt;
+            sslRootCertFile = mylib.relativeToRoot "certs/ecc-ca.crt";
           };
           editable = false;
         }

hosts/k8s/kubevirt-youko/homelab-services/postgresql.nix

@@ -1,5 +1,6 @@
 {
   config,
+  mylib,
   pkgs,
   lib,
   myvars,
@@ -69,7 +70,7 @@ in
 
       # ssl
       ssl = true;
-      ssl_cert_file = "${../../certs/ecc-server.crt}";
+      ssl_cert_file = "${mylib.relativeToRoot "certs/ecc-server.crt"}";
       ssl_key_file = config.age.secrets."postgres-ecc-server.key".path;
       ssl_min_protocol_version = "TLSv1.3";
       ssl_ecdh_curve = "secp384r1";