fix(observability): seed grafana's OAuth secret into a per-service env file

The first deploy of the grafana unit failed: 'stat /root/.config: permission
denied', exit 1, restart loop. Cause — the repo-root .env that the compose
service used to pick up is a gluetun env file, and it carries HOME=/root (and
the WireGuard keys). Pointing the unit's [Service] EnvironmentFile at it sets
HOME for the service, so podman looks for its configuration under /root.

grafana now reads /home/dank/Containers/grafana/env, the per-service file the
deployer seeds from dankclaw/.env with a single-variable filter — the same
shape caddy, pihole, copyparty, romm and seerr use. The seed is validated, so
a missing secret fails the deploy loudly instead of starting a container whose
OAuth login cannot complete. The value was copied to dankclaw/.env, which is
where dankclaw/.env.example already documented it.

dankclaw/observability/quadlet/grafana.container

@@ -62,9 +62,16 @@ HealthRetries=3
 HealthStartPeriod=60s
 
 [Service]
-# systemd-side only: supplies ${GRAFANA_OAUTH_CLIENT_SECRET} for expansion
-# above. The container does not receive this file.
-EnvironmentFile=/home/dank/serverAppConfigs/.env
+# systemd-side only: supplies ${GRAFANA_OAUTH_CLIENT_SECRET} for the expansion
+# above. The container never receives this file.
+#
+# It is the per-service env file the deployer seeds from dankclaw/.env — the
+# fleet convention (caddy, pihole, copyparty, romm and seerr all read one).
+# The repo-root .env that the compose service happened to pick up is a gluetun
+# env file: it carries HOME=/root and the WireGuard keys, and importing it into
+# this service makes podman look for its configuration under /root, which it
+# cannot read, so the unit fails to start. Seed the value into dankclaw/.env.
+EnvironmentFile=/home/dank/Containers/grafana/env
 Restart=always
 RestartSec=10