grafana: auth_proxy behind the Authentik guard chain

Grafana leaves the exempt-by-construction set: grafana.franksdank.cloud
now terminates at the Anubis guard (anubis:8923) and authenticated
traffic returns at the internal :8017 listener, where an @grafana Host
handler proxies through to grafana:3000 with the outpost-proxy trust
token (GRAFANA_PROXY_TOKEN = client_id_client_secret of the new
'grafana-proxy' ProxyProvider on the embedded outpost; created via
ak shell before this route flip — provider-first ordering per the
External Exposure Policy).

The Grafana admin account is intentionally kept: auth.proxy in
auto-upsert mode only creates non-admin users, so the local admin
remains the only way to administer Grafana. The old edge-basicauth
wrapper is retired (shared family password, no per-user audit trail).

- Caddyfile: grafana vhost flipped to the guarded chain; @grafana
  handler added at the :8017 return listener.
- compose.yaml: GF_AUTH_PROXY_ENABLED/HEADERS/TOKEN on the grafana
  service (auth_proxy trusted-proxy CIDRs left at the image default —
  the proxying Caddy container is not statically addressable on
  10.89.0.0/24, so Grafana trusts any in-network source and relies on
  the token as the capability).
- .env.example: GRAFANA_PROXY_TOKEN placeholder so test env_consistency
  keeps guarding the compose<->env contract.

dankclaw/.env.example

@@ -20,16 +20,18 @@ WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL=25s
 # Gitea database
 GITEA_DB_PASSWORD=changeme
 
-# Grafana admin
-GRAFANA_ADMIN_USER=admin
-GRAFANA_ADMIN_PASSWORD=changeme
+# Grafana auth-proxy trust token. The outpost proxy provider 'grafana-proxy'
+# forwards authenticated traffic to Grafana with Authorization: Bearer
+# <client_id>_<client_secret>; the live .env must set this to that exact
+# concatenation (provider created via ak shell on authentik-server).
+GRAFANA_PROXY_TOKEN=changeme
 
 # Caddy (the homelab's single reverse proxy, on this host)
 # bcrypt hash (caddy hash-password). deploy.sh renders it into
-# /home/dank/Containers/caddy/Caddyfile.
-# CADDY_BASICAUTH_HASH: the shared family password, still used by the
-#   vhosts that carry basicauth rather than Authentik forward_auth
-#   (grafana, pihole). Username: dankuser.
+# /home/dank/Containers/caddy/Caddyfile, which the container mounts.
+# CADDY_BASICAUTH_HASH: the shared family password, now used only by the
+#   pihole vhost (grafana moved behind the Authentik guard chain 2026-09-01).
+#   Username: dankuser.
 CADDY_BASICAUTH_HASH=changeme
 # (The homepage's per-user hashes were retired: the homepage and its /admin/
 #  page are now behind Authentik forward_auth, not basicauth.)