Dashboards in Grafana; clean up after the Next.js app

- k8s/grafana.yaml: Grafana 13.2.3 with a 1Gi PVC, sign-up and
  anonymous access off. The InfluxDB datasource (URL and token from the
  environment) and three dashboards — Live, Consumption, Charging — are
  provisioned from k8s/grafana/ via kustomize-generated ConfigMaps.
- server.yaml for the Go server (port 8080, UID 65532, smaller limits),
  image tag 2.0.0. The NetworkPolicy now admits Grafana to InfluxDB.
- ingress.yaml: IngressRoutes for car.stinnesbeck.com and Grafana
  (placeholder host car-grafana.stinnesbeck.com) with tls: {}, using
  Traefik's default certificate; the cert-manager Certificate is gone.
- secrets.example.yaml: drops the dashboard secrets, adds grafana-admin.
- AGENTS.md loses its Next.js block; SPECS.md describes the new setup.

The removal of web/ (the Next.js app) and of the stale .next/ cache
upstream had committed already landed in 51e6f6f, which was staged
together with the Go server by mistake.

Checked end to end in podman (Go server + InfluxDB 2.7.12 + Grafana
13.2.3): all 25 dashboard queries return the expected data, and the
dashboards were rendered with headless Chromium. Manifests validated
offline with kustomize and kubeconform. Nothing applied to a cluster.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki

k8s/ingress.yaml

@@ -1,18 +1,5 @@
-# TLS certificate from cert-manager. cert-manager does not watch Traefik IngressRoutes, so the
-# certificate is requested explicitly and the IngressRoute references its Secret.
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: car-stinnesbeck-com
-  namespace: mg4
-spec:
-  secretName: car-stinnesbeck-com-tls
-  dnsNames:
-    - car.stinnesbeck.com
-  issuerRef:
-    kind: ClusterIssuer
-    name: letsencrypt-prod
----
+# Public routes. TLS uses Traefik's default certificate, so there is no per-host
+# Certificate here.
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
@@ -20,7 +7,7 @@ metadata:
   namespace: mg4
   annotations:
     # CHECK: the class of your public-facing Traefik. Your internal example uses
-    # "traefik-internal"; this host must be served by the external one.
+    # "traefik-internal"; these hosts must be served by the external one.
     kubernetes.io/ingress.class: traefik-external
 spec:
   entryPoints:
@@ -33,5 +20,25 @@ spec:
           name: mg4-server
           namespace: mg4
           port: 80
-  tls:
-    secretName: car-stinnesbeck-com-tls
+  tls: {}
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: grafana
+  namespace: mg4
+  annotations:
+    kubernetes.io/ingress.class: traefik-external # CHECK, as above
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - kind: Rule
+      # CHECK: placeholder host. It must be covered by Traefik's default certificate.
+      match: Host(`car-grafana.stinnesbeck.com`)
+      services:
+        - kind: Service
+          name: grafana
+          namespace: mg4
+          port: 80
+  tls: {}