grafana: switch auth_proxy -> OAuth2 relying-party against authentik

The embedded outpost carries no provider token (token=None), so the
auth_proxy identity header was never set and no user could log in. RP
mode is topology-independent: challenge gate stays in front, login runs
inside Grafana via the OAuth2 code flow against auth.franksdank.cloud.

Provider 'grafana' (pk 9, confidential) created via ak shell; secret
written straight into the live .env (never in git). Auth URL uses the
global /application/o/authorize/ path — this fork resolves the provider
by client_id query param; per-slug authorize does not exist.
Caddyfile comment corrected: no identity header is forwarded to Grafana.

dankclaw/compose.yaml

@@ -177,14 +177,29 @@ services:
     user: "0:0"
     environment:
       GF_SERVER_ROOT_URL: "https://grafana.franksdank.cloud"
-      # Auth proxy mode: the authentik embedded outpost proxies authenticated
-      # traffic through with Authorization: Bearer <client_id>_<client_secret>
-      # (the grafana-proxy provider on the outpost). The token lives in the
-      # host .env (never committed); auto-upsert maps each authenticated
-      # authentik user to a Grafana user by email, default role Viewer.
-      GF_AUTH_PROXY_ENABLED: "true"
-      GF_AUTH_PROXY_HEADERS: "name Auth;logo https://grafana.franksdank.cloud/public/img/login-app-logo.png;auto-upsert"
-      GF_AUTH_PROXY_TOKEN: "${GRAFANA_PROXY_TOKEN}"
+      # Auth model = OAuth2 relying party against authentik (OAuth2Provider
+      # name "grafana", pk 9, confidential client_type, created via ak shell).
+      # Chosen over auth_proxy because the embedded outpost carries no provider
+      # token (token=None), so no identity header ever reaches Grafana — RP mode
+      # works regardless of outpost topology. The public vhost stays behind the
+      # Anubis challenge + outpost gate; login happens inside Grafana via the
+      # Authentik button. Users auto-upsert as Viewer (no role mapping yet);
+      # the local admin account remains the only Admin.
+      GF_AUTH_GENERIC_OAUTH_ENABLED: "true"
+      GF_AUTH_GENERIC_OAUTH_NAME: "Authentik"
+      GF_AUTH_GENERIC_OAUTH_CLIENT_ID: "grafana-21ca190cde75d60f"
+      GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: "${GRAFANA_OAUTH_CLIENT_SECRET}"
+      # Global authorize path: this fork resolves the provider by client_id
+      # query param — /application/o/<slug>/authorize/ does not exist here.
+      GF_AUTH_GENERIC_OAUTH_AUTH_URL: "https://auth.franksdank.cloud/application/o/authorize/"
+      GF_AUTH_GENERIC_OAUTH_TOKEN_URL: "https://auth.franksdank.cloud/application/o/token/"
+      # ?api=1 = introspection-style userinfo: returns all custom claims
+      # (entitlements/groups) for access tokens, not just the standard set.
+      GF_AUTH_GENERIC_OAUTH_API_URL: "https://auth.franksdank.cloud/application/o/userinfo/?api=1"
+      GF_AUTH_GENERIC_OAUTH_ALLOW_SIGN_UP: "false"
+      GF_AUTH_GENERIC_OAUTH_AUTO_UPSERT: "true"
+      GF_AUTH_GENERIC_OAUTH_ALLOW_ASSIGN_ORG: "true"
+      GF_AUTH_GENERIC_OAUTH_ORG_ID: "1"
     ports:
       - "3002:3000"
     volumes: