Dashboards in Grafana; clean up after the Next.js app

- k8s/grafana.yaml: Grafana 13.2.3 with a 1Gi PVC, sign-up and
  anonymous access off. The InfluxDB datasource (URL and token from the
  environment) and three dashboards — Live, Consumption, Charging — are
  provisioned from k8s/grafana/ via kustomize-generated ConfigMaps.
- server.yaml for the Go server (port 8080, UID 65532, smaller limits),
  image tag 2.0.0. The NetworkPolicy now admits Grafana to InfluxDB.
- ingress.yaml: IngressRoutes for car.stinnesbeck.com and Grafana
  (placeholder host car-grafana.stinnesbeck.com) with tls: {}, using
  Traefik's default certificate; the cert-manager Certificate is gone.
- secrets.example.yaml: drops the dashboard secrets, adds grafana-admin.
- AGENTS.md loses its Next.js block; SPECS.md describes the new setup.

The removal of web/ (the Next.js app) and of the stale .next/ cache
upstream had committed already landed in 51e6f6f, which was staged
together with the Go server by mistake.

Checked end to end in podman (Go server + InfluxDB 2.7.12 + Grafana
13.2.3): all 25 dashboard queries return the expected data, and the
dashboards were rendered with headless Chromium. Manifests validated
offline with kustomize and kubeconform. Nothing applied to a cluster.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki

k8s/secrets.example.yaml

@@ -1,7 +1,7 @@
 # TEMPLATE ONLY — not part of kustomization.yaml. Copy it outside the repository, fill in
 # real values, and apply that copy yourself. Never commit the filled-in file.
 #
-#   openssl rand -hex 32     for every token and secret below
+#   openssl rand -hex 32     for every token and password below
 apiVersion: v1
 kind: Secret
 metadata:
@@ -19,15 +19,25 @@ metadata:
   namespace: mg4
 type: Opaque
 stringData:
-  # The car's write token, entered in the app. At least 24 characters.
+  # The car's write token, entered in the app. At least 24 characters, or the server
+  # refuses to start.
   INGEST_TOKEN: CHANGE-ME-openssl-rand-hex-32
-  SESSION_SECRET: CHANGE-ME-openssl-rand-hex-32
-  DASHBOARD_PASSWORD: CHANGE-ME-at-least-8-characters
   # Your ABRP credentials. Leave either empty to switch forwarding off.
   ABRP_API_KEY: CHANGE-ME
   ABRP_USER_TOKEN: CHANGE-ME
   ABRP_MIN_INTERVAL_SECONDS: "5"
 ---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: grafana-admin
+  namespace: mg4
+type: Opaque
+stringData:
+  # Grafana's admin login (user "admin"). Only read on first start: change it in Grafana
+  # afterwards, or reset it with grafana cli.
+  admin-password: CHANGE-ME
+---
 # Pull secret for a private image on git.stinnesbeck.com. Easier to create with:
 #   kubectl -n mg4 create secret docker-registry git-stinnesbeck-registry \
 #     --docker-server=git.stinnesbeck.com --docker-username=<user> --docker-password=<token>