refactor(monitoring): move grafana into the main compose stack

Owner request: one 'docker compose up -d' should bring the whole system up —
no separate monitoring project to start for the dashboards.

- docker-compose.yml: grafana service (procurement-grafana, loopback :3001,
  default+shared networks, obs datasource env) + grafana_data volume;
  provisioning and dashboard JSONs stay in ./monitoring/grafana/ (no file
  moves, provisioning unchanged)
- docker-compose.prod.yml: GRAFANA_ADMIN_PASSWORD forced via the existing
  ${VAR:?} pattern (local keeps a lenient default, prod refuses defaults)
- monitoring/docker-compose.monitoring.yml: grafana service + volume removed
  (no name/port conflict); glitchtip/prometheus/loki stay server-side as before
- docs updated: grafana restarts on app deploys are harmless (settings live
  in the volume); SSH-tunnel posture unchanged

Verified locally: both compose files validate; 'docker compose up -d' starts
all 10 services incl. procurement-grafana; BotPostgres datasource health OK;
all 3 dashboards provisioned in the fresh volume; monitoring compose no
longer contains grafana; old monitoring-grafana container removed; port
still loopback-only.

docker-compose.yml

@@ -362,6 +362,37 @@ services:
     restart: unless-stopped
     mem_limit: 512m
 
+  # ---------------------------------------------------------------- grafana --
+  # Bot-observability dashboards — part of the MAIN stack (owner decision
+  # 2026-10-25: one `docker compose up -d` brings everything up). Provisioning
+  # and dashboard JSONs live in ./monitoring/grafana/ and stay shared with the
+  # server-side monitoring docs. Loopback-only, reads Postgres via obs_reader.
+  grafana:
+    image: grafana/grafana:11.6.3
+    container_name: procurement-grafana
+    mem_limit: 256m
+    environment:
+      GF_SECURITY_ADMIN_USER: admin
+      GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_ADMIN_PASSWORD:-grafana-admin}
+      GF_USERS_ALLOW_SIGN_UP: "false"
+      GF_SERVER_ROOT_URL: ${GRAFANA_ROOT_URL:-http://localhost:3001/}
+      # Bot-observability Postgres datasource (provisioned from datasources.yml)
+      OBS_DB_HOST: postgres
+      OBS_DB_PORT: "5432"
+      OBS_DB_NAME: procurement
+      OBS_DB_USER: ${OBS_READER_USER:-obs_reader}
+      OBS_DB_PASSWORD: ${PROCUREMENT_BOT_OBS_READER_PASSWORD:-}
+    volumes:
+      - grafana_data:/var/lib/grafana
+      - ./monitoring/grafana/provisioning:/etc/grafana/provisioning:ro
+      - ./monitoring/grafana/dashboards:/var/lib/grafana/dashboards:ro
+    ports:
+      - "127.0.0.1:3001:3000"
+    networks:
+      - default
+      - shared   # reaches postgres for the bot_traces/bot_trace_events datasource
+    restart: unless-stopped
+
 networks:
   # شبکه‌ی عمومی: فقط ترافیک و سرویس‌های عمومی. postgres روی شبکه‌ی
   # پیش‌فرض می‌ماند و از بیرون قابل دسترسی نیست.
@@ -378,3 +409,4 @@ volumes:
   postgres_data:
   minio_data:
   traefik_certs:
+  grafana_data: