grafana: auth_proxy behind the Authentik guard chain

Grafana leaves the exempt-by-construction set: grafana.franksdank.cloud
now terminates at the Anubis guard (anubis:8923) and authenticated
traffic returns at the internal :8017 listener, where an @grafana Host
handler proxies through to grafana:3000 with the outpost-proxy trust
token (GRAFANA_PROXY_TOKEN = client_id_client_secret of the new
'grafana-proxy' ProxyProvider on the embedded outpost; created via
ak shell before this route flip — provider-first ordering per the
External Exposure Policy).

The Grafana admin account is intentionally kept: auth.proxy in
auto-upsert mode only creates non-admin users, so the local admin
remains the only way to administer Grafana. The old edge-basicauth
wrapper is retired (shared family password, no per-user audit trail).

- Caddyfile: grafana vhost flipped to the guarded chain; @grafana
  handler added at the :8017 return listener.
- compose.yaml: GF_AUTH_PROXY_ENABLED/HEADERS/TOKEN on the grafana
  service (auth_proxy trusted-proxy CIDRs left at the image default —
  the proxying Caddy container is not statically addressable on
  10.89.0.0/24, so Grafana trusts any in-network source and relies on
  the token as the capability).
- .env.example: GRAFANA_PROXY_TOKEN placeholder so test env_consistency
  keeps guarding the compose<->env contract.

dankclaw/compose.yaml

@@ -177,8 +177,14 @@ services:
     user: "0:0"
     environment:
       GF_SERVER_ROOT_URL: "https://grafana.franksdank.cloud"
-      GF_SECURITY_ADMIN_USER: "${GRAFANA_ADMIN_USER}"
-      GF_SECURITY_ADMIN_PASSWORD: "${GRAFANA_ADMIN_PASSWORD}"
+      # Auth proxy mode: the authentik embedded outpost proxies authenticated
+      # traffic through with Authorization: Bearer <client_id>_<client_secret>
+      # (the grafana-proxy provider on the outpost). The token lives in the
+      # host .env (never committed); auto-upsert maps each authenticated
+      # authentik user to a Grafana user by email, default role Viewer.
+      GF_AUTH_PROXY_ENABLED: "true"
+      GF_AUTH_PROXY_HEADERS: "name Auth;logo https://grafana.franksdank.cloud/public/img/login-app-logo.png;auto-upsert"
+      GF_AUTH_PROXY_TOKEN: "${GRAFANA_PROXY_TOKEN}"
     ports:
       - "3002:3000"
     volumes: