fix(observability): seed grafana's OAuth secret into a per-service env file

The first deploy of the grafana unit failed: 'stat /root/.config: permission
denied', exit 1, restart loop. Cause — the repo-root .env that the compose
service used to pick up is a gluetun env file, and it carries HOME=/root (and
the WireGuard keys). Pointing the unit's [Service] EnvironmentFile at it sets
HOME for the service, so podman looks for its configuration under /root.

grafana now reads /home/dank/Containers/grafana/env, the per-service file the
deployer seeds from dankclaw/.env with a single-variable filter — the same
shape caddy, pihole, copyparty, romm and seerr use. The seed is validated, so
a missing secret fails the deploy loudly instead of starting a container whose
OAuth login cannot complete. The value was copied to dankclaw/.env, which is
where dankclaw/.env.example already documented it.

scripts/deploy-remote.sh

@@ -378,6 +378,24 @@ deploy_compose_service() {
     esac
 }
 
+# grafana is the one observability service that holds a credential: the
+# Authentik OAuth2 client secret. It is seeded into a per-service env file (the
+# fleet convention: caddy, pihole, copyparty, romm, seerr) instead of being
+# imported from the repo .env wholesale. The repo-root .env that the compose
+# service used to pick up is a gluetun env file — it also carries HOME=/root
+# and the WireGuard keys, and an EnvironmentFile of that file sets HOME for the
+# service, which makes podman look for its config under /root and fail.
+seed_grafana_env() {
+    local dest=/home/dank/Containers/grafana/env
+    mkdir -p /home/dank/Containers/grafana
+    if [[ ! -f "$dest" ]]; then
+        awk -F= '/^GRAFANA_OAUTH_CLIENT_SECRET=/ { print }' dankclaw/.env > "$dest"
+        chmod 600 "$dest"
+    fi
+    grep -q '^GRAFANA_OAUTH_CLIENT_SECRET=.' "$dest" \
+        || { echo "grafana env missing GRAFANA_OAUTH_CLIENT_SECRET; set it in dankclaw/.env" >&2; return 1; }
+}
+
 # The five observability containers left compose on 2026-09-11 (they were
 # started by hand with podman-compose and never came back after a reboot).
 # They are ordinary rootless Quadlet units now: same images, same mounts, same
@@ -399,7 +417,10 @@ deploy_observability() {
             copy_alloy_config
             build_compose_image alloy
             ;;
-        grafana|node-exporter)
+        grafana)
+            seed_grafana_env || return 1
+            ;;
+        node-exporter)
             ;;
         *)
             echo "unknown observability service: $service" >&2