grafana: switch auth_proxy -> OAuth2 relying-party against authentik

The embedded outpost carries no provider token (token=None), so the
auth_proxy identity header was never set and no user could log in. RP
mode is topology-independent: challenge gate stays in front, login runs
inside Grafana via the OAuth2 code flow against auth.franksdank.cloud.

Provider 'grafana' (pk 9, confidential) created via ak shell; secret
written straight into the live .env (never in git). Auth URL uses the
global /application/o/authorize/ path — this fork resolves the provider
by client_id query param; per-slug authorize does not exist.
Caddyfile comment corrected: no identity header is forwarded to Grafana.

dankclaw/Caddyfile

@@ -26,9 +26,9 @@
 # Authentik IdP itself (auth.franksdank.cloud — its login flow must never sit
 # behind a challenge) are exempt by construction: their vhosts never route
 # through Anubis. ComfyUI left this exempt set on 2026-08-31 and Grafana left
-# it on 2026-09-01 (auth_proxy mode; the outpost proxies authenticated traffic
-# through to it): both now sit behind the guard chain with their proxy
-# providers registered on the embedded outpost.
+# it on 2026-09-01 (OAuth2 relying-party mode against authentik): both now sit
+# behind the guard chain; Grafana authenticates users itself via the OAuth2
+# code flow, so no identity header is forwarded to it.
 # The pihole vhost keeps its basicauth edge; the hash placeholder below is
 # rendered by deploy.sh from CADDY_BASICAUTH_HASH (host .env, git-ignored) into
 # /home/dank/Containers/caddy/Caddyfile, which the container mounts.
@@ -133,10 +133,11 @@ gitea.franksdank.cloud {
 	reverse_proxy 192.168.0.143:3000
 }
 
-# --- Grafana (guarded: Anubis → Authentik; grafana-proxy provider, auth_proxy mode) ---
-# Authenticated traffic returns at the internal :8017 listener and is proxied
-# through by the outpost with Authorization: Bearer <client_id>_<client_secret>;
-# Grafana's auth.proxy trusts that token and auto-upserts a user per login.
+# --- Grafana (guarded: Anubis → Authentik outpost gate; login inside Grafana) ---
+# Auth model = OAuth2 relying party against authentik (OAuth2Provider "grafana",
+# confidential client). The guard chain gates unauthenticated traffic; the
+# outpost carries no provider token in this deployment, so identity headers
+# never reach Grafana — RP mode needs none and works regardless of topology.
 # The basicauth edge this replaces (CADDY_BASICAUTH_HASH) is retired.
 grafana.franksdank.cloud {
 	reverse_proxy anubis:8923 {