FIX(tempo): move extraEnv under tempo section for S3 credentials

- Move extraEnv from top-level to tempo section where chart expects it
- Move extraVolumeMounts under tempo section for proper WAL mounting
- Fixes Access Denied error when connecting to MinIO

tempo/helm-values.yaml

@@ -63,22 +63,8 @@ tempo:
     enabled: true
     remoteWriteUrl: http://prometheus-kube-prometheus-prometheus.prometheus.svc:9090/api/v1/write
 
-# =============================================================================
-# Persistence - Disabled (use emptyDir for WAL, data in MinIO)
-# =============================================================================
-persistence:
-  enabled: false
-
-# emptyDir for WAL
-extraVolumes:
-  - name: tempo-data
-    emptyDir: {}
-extraVolumeMounts:
-  - name: tempo-data
-    mountPath: /var/tempo
-
-# MinIO S3 credentials
-extraEnv:
+  # MinIO S3 credentials
+  extraEnv:
     - name: AWS_ACCESS_KEY_ID
       valueFrom:
         secretKeyRef:
@@ -90,6 +76,22 @@ extraEnv:
           name: minio-s3-credentials
           key: AWS_SECRET_ACCESS_KEY
 
+  # Additional volume mounts for WAL
+  extraVolumeMounts:
+    - name: tempo-data
+      mountPath: /var/tempo
+
+# =============================================================================
+# Persistence - Disabled (use emptyDir for WAL, data in MinIO)
+# =============================================================================
+persistence:
+  enabled: false
+
+# emptyDir volume for WAL
+extraVolumes:
+  - name: tempo-data
+    emptyDir: {}
+
 # =============================================================================
 # Service
 # =============================================================================