Make ProxyClass default for all Tailscale proxies

- Set `default: true` on ProxyClass so all Services/Ingresses use it
- Remove explicit proxy-class annotation from databases service
- Fixes CRI-O short image name issue globally for Tailscale resources

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

argocd/manifests/databases/service-tailscale.yaml

@@ -8,7 +8,6 @@ metadata:
   namespace: databases
   annotations:
     tailscale.com/hostname: "k8s-pg"
-    tailscale.com/proxy-class: "default"
 spec:
   type: LoadBalancer
   loadBalancerClass: tailscale

argocd/manifests/tailscale-operator/proxyclass.yaml

@@ -2,15 +2,15 @@
 # CRI-O cannot resolve short image names, so we must use fully-qualified references.
 # This ProxyClass sets the tailscale container images to use docker.io prefix.
 #
-# Apply this after operator.yaml. Services should reference this via:
-#   annotations:
-#     tailscale.com/proxy-class: "default"
+# With `default: true`, this ProxyClass is automatically applied to all
+# Services/Ingresses that don't explicitly specify a different proxy-class.
 ---
 apiVersion: tailscale.com/v1alpha1
 kind: ProxyClass
 metadata:
   name: default
 spec:
+  default: true
   statefulSet:
     pod:
       tailscaleContainer: