refactor(monitoring): move grafana into the main compose stack

Owner request: one 'docker compose up -d' should bring the whole system up —
no separate monitoring project to start for the dashboards.

- docker-compose.yml: grafana service (procurement-grafana, loopback :3001,
  default+shared networks, obs datasource env) + grafana_data volume;
  provisioning and dashboard JSONs stay in ./monitoring/grafana/ (no file
  moves, provisioning unchanged)
- docker-compose.prod.yml: GRAFANA_ADMIN_PASSWORD forced via the existing
  ${VAR:?} pattern (local keeps a lenient default, prod refuses defaults)
- monitoring/docker-compose.monitoring.yml: grafana service + volume removed
  (no name/port conflict); glitchtip/prometheus/loki stay server-side as before
- docs updated: grafana restarts on app deploys are harmless (settings live
  in the volume); SSH-tunnel posture unchanged

Verified locally: both compose files validate; 'docker compose up -d' starts
all 10 services incl. procurement-grafana; BotPostgres datasource health OK;
all 3 dashboards provisioned in the fresh volume; monitoring compose no
longer contains grafana; old monitoring-grafana container removed; port
still loopback-only.

monitoring/README.md

@@ -21,10 +21,12 @@ cd /srv/erp   # the repo checkout used by the deploy webhook
 #    GLITCHTIP_SECRET_KEY, GLITCHTIP_DOMAIN/HOST, GLITCHTIP_DB_PASSWORD,
 #    GRAFANA_ADMIN_PASSWORD, POSTGRES_PASSWORD (already set), LOG_FORMAT=json
 
-# 2) the main compose gained a shared network — re-up once so it exists:
+# 2) the main compose gained a shared network — re-up once so it exists.
+#    NOTE (2026-10-25): GRAFANA MOVED into the main docker-compose.yml —
+#    this one command now brings the app AND grafana up together:
 docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d
 
-# 3) start monitoring:
+# 3) start the REST of monitoring (glitchtip/prometheus/loki — no grafana):
 docker compose -f monitoring/docker-compose.monitoring.yml --env-file .env up -d
 
 # 4) GlitchTip is routed publicly through Traefik for the browser SDK:
@@ -36,7 +38,9 @@ Admin UIs stay **loopback-only** (same posture as the MinIO console):
 
 ```powershell
 ssh -L 3001:127.0.0.1:3001 -L 8001:127.0.0.1:8001 <user>@<server-host>
-# Grafana  → http://localhost:3001  (dashboards auto-provisioned)
+# Grafana  → http://localhost:3001  (runs in the MAIN app stack since
+#            2026-10-25; dashboards auto-provisioned; restarts on app deploys
+#            are harmless — settings live in the grafana_data volume)
 # GlitchTip → http://localhost:8001 (create the first admin on first open)
 ```
 
@@ -156,8 +160,11 @@ webhook uses it post-rebuild regardless of the metrics stack.
 
 ## Local runs (Docker Desktop)
 
-Start WITHOUT `--profile host-metrics` — node-exporter and cAdvisor need
-Linux rootfs mounts and will fail to start on Windows/macOS hosts:
+Grafana starts with the app stack — plain `docker compose up -d` from the
+repo root brings api/frontend/bot/postgres/… **and grafana** (loopback
+:3001). For the rest of the monitoring stack start WITHOUT
+`--profile host-metrics` — node-exporter and cAdvisor need Linux rootfs
+mounts and will fail to start on Windows/macOS hosts:
 
 ```bash
 docker compose -f monitoring/docker-compose.monitoring.yml --env-file .env up -d