fix(observability): seed grafana's OAuth secret into a per-service env file

The first deploy of the grafana unit failed: 'stat /root/.config: permission
denied', exit 1, restart loop. Cause — the repo-root .env that the compose
service used to pick up is a gluetun env file, and it carries HOME=/root (and
the WireGuard keys). Pointing the unit's [Service] EnvironmentFile at it sets
HOME for the service, so podman looks for its configuration under /root.

grafana now reads /home/dank/Containers/grafana/env, the per-service file the
deployer seeds from dankclaw/.env with a single-variable filter — the same
shape caddy, pihole, copyparty, romm and seerr use. The seed is validated, so
a missing secret fails the deploy loudly instead of starting a container whose
OAuth login cannot complete. The value was copied to dankclaw/.env, which is
where dankclaw/.env.example already documented it.

tests/observability_quadlet.bats

@@ -146,17 +146,32 @@ service_section() {
     done
 }
 
-@test "grafana receives the OAuth client secret without receiving the whole .env" {
-    # systemd expands ${GRAFANA_OAUTH_CLIENT_SECRET} in [Container] from the
-    # [Service] EnvironmentFile. Putting that file in [Container] would hand
-    # the container every fleet secret in it (Porkbun keys, Authentik keys,
-    # the sudo password file's neighbours) for the sake of one value.
+@test "grafana gets its OAuth client secret without getting a whole env file" {
+    # systemd expands ${GRAFANA_OAUTH_CLIENT_SECRET} for the [Container]
+    # Environment= line from the [Service] EnvironmentFile, which keeps the
+    # file out of the container entirely. That file is the per-service one the
+    # deployer seeds (fleet convention: caddy, pihole, copyparty, romm, seerr)
+    # — NOT a repo .env. The repo-root .env the compose service happened to
+    # read is a gluetun env file carrying HOME=/root and the WireGuard keys;
+    # importing it sets HOME for this service and podman then looks for its
+    # configuration under /root and refuses to start.
     local unit="$UNIT_DIR/grafana.container"
-    service_section "$unit" | grep -q '^EnvironmentFile=/home/dank/serverAppConfigs/.env$'
+    service_section "$unit" | grep -q '^EnvironmentFile=/home/dank/Containers/grafana/env$'
+    ! service_section "$unit" | grep -q 'serverAppConfigs'
     ! container_section "$unit" | grep -q '^EnvironmentFile='
     container_section "$unit" | grep -q '^Environment=GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET=\${GRAFANA_OAUTH_CLIENT_SECRET}$'
 }
 
+@test "the deployer seeds exactly one value into the grafana env file" {
+    # The single-variable filter is the point: a whole-file copy is how the
+    # HOME=/root failure got in.
+    grep -q '^seed_grafana_env() {' "$REMOTE_DEPLOY"
+    grep -q '^    local dest=/home/dank/Containers/grafana/env$' "$REMOTE_DEPLOY"
+    grep -q "awk -F= '/^GRAFANA_OAUTH_CLIENT_SECRET=/ { print }' dankclaw/.env > \"\$dest\"" "$REMOTE_DEPLOY"
+    grep -q "grep -q '\^GRAFANA_OAUTH_CLIENT_SECRET=\.' \"\$dest\"" "$REMOTE_DEPLOY"
+    grep -q 'seed_grafana_env || return 1' "$REMOTE_DEPLOY"
+}
+
 @test "observability units hold no literal secret material" {
     # A secret-named setting is allowed only when its value is a ${VAR}
     # reference resolved from an EnvironmentFile systemd reads; a literal value