grafana: auth_proxy behind the Authentik guard chain

Grafana leaves the exempt-by-construction set: grafana.franksdank.cloud
now terminates at the Anubis guard (anubis:8923) and authenticated
traffic returns at the internal :8017 listener, where an @grafana Host
handler proxies through to grafana:3000 with the outpost-proxy trust
token (GRAFANA_PROXY_TOKEN = client_id_client_secret of the new
'grafana-proxy' ProxyProvider on the embedded outpost; created via
ak shell before this route flip — provider-first ordering per the
External Exposure Policy).

The Grafana admin account is intentionally kept: auth.proxy in
auto-upsert mode only creates non-admin users, so the local admin
remains the only way to administer Grafana. The old edge-basicauth
wrapper is retired (shared family password, no per-user audit trail).

- Caddyfile: grafana vhost flipped to the guarded chain; @grafana
  handler added at the :8017 return listener.
- compose.yaml: GF_AUTH_PROXY_ENABLED/HEADERS/TOKEN on the grafana
  service (auth_proxy trusted-proxy CIDRs left at the image default —
  the proxying Caddy container is not statically addressable on
  10.89.0.0/24, so Grafana trusts any in-network source and relies on
  the token as the capability).
- .env.example: GRAFANA_PROXY_TOKEN placeholder so test env_consistency
  keeps guarding the compose<->env contract.

dankclaw/Caddyfile

@@ -22,15 +22,16 @@
 # CHALLENGE everyone else) → Caddy's internal listener http://:8016 (auth
 # decision; Host headers survive every hop) → authenticated traffic is
 # forwarded back to http://:8017 and routed straight to the app.
-# Apps with their own auth (Grafana, Gitea, OpenWebUI, Jellyfin, *arr, Pi-hole)
-# and the Authentik IdP itself (auth.franksdank.cloud — its login flow must never
-# sit behind a challenge) are exempt by construction: their vhosts never route
-# through Anubis. ComfyUI left this exempt set on 2026-08-31: it now sits behind
-# the guard chain with the comfyui-proxy provider registered on the embedded outpost.
-# their vhosts never route through Anubis. The basicauth hash is a
-# placeholder; deploy.sh renders the real hash (CADDY_BASICAUTH_HASH from the
-# host .env, git-ignored) into /home/dank/Containers/caddy/Caddyfile, which
-# the container mounts.
+# Apps with their own auth (Gitea, OpenWebUI, Jellyfin, *arr, Pi-hole) and the
+# Authentik IdP itself (auth.franksdank.cloud — its login flow must never sit
+# behind a challenge) are exempt by construction: their vhosts never route
+# through Anubis. ComfyUI left this exempt set on 2026-08-31 and Grafana left
+# it on 2026-09-01 (auth_proxy mode; the outpost proxies authenticated traffic
+# through to it): both now sit behind the guard chain with their proxy
+# providers registered on the embedded outpost.
+# The pihole vhost keeps its basicauth edge; the hash placeholder below is
+# rendered by deploy.sh from CADDY_BASICAUTH_HASH (host .env, git-ignored) into
+# /home/dank/Containers/caddy/Caddyfile, which the container mounts.
 #
 # TLS: real Let's Encrypt certs. Site addresses carry no http:// prefix,
 # so Caddy serves HTTPS (and auto-redirects HTTP). Certs are issued via
@@ -132,12 +133,15 @@ gitea.franksdank.cloud {
 	reverse_proxy 192.168.0.143:3000
 }
 
-# --- Grafana ---
+# --- Grafana (guarded: Anubis → Authentik; grafana-proxy provider, auth_proxy mode) ---
+# Authenticated traffic returns at the internal :8017 listener and is proxied
+# through by the outpost with Authorization: Bearer <client_id>_<client_secret>;
+# Grafana's auth.proxy trusts that token and auto-upserts a user per login.
+# The basicauth edge this replaces (CADDY_BASICAUTH_HASH) is retired.
 grafana.franksdank.cloud {
-	basicauth {
-		dankuser REPLACE_WITH_HASH
+	reverse_proxy anubis:8923 {
+		header_up X-Real-Ip {remote_host}
 	}
-	reverse_proxy grafana:3000
 }
 
 # --- Prometheus ---
@@ -302,6 +306,11 @@ http://:8017 {
 		reverse_proxy loki:3100
 	}
 
+	@grafana host grafana.franksdank.cloud
+	handle @grafana {
+		reverse_proxy grafana:3000
+	}
+
 	@prometheus host prometheus.franksdank.cloud
 	handle @prometheus {
 		reverse_proxy prometheus:9090