Dashboards in Grafana; clean up after the Next.js app

- k8s/grafana.yaml: Grafana 13.2.3 with a 1Gi PVC, sign-up and
  anonymous access off. The InfluxDB datasource (URL and token from the
  environment) and three dashboards — Live, Consumption, Charging — are
  provisioned from k8s/grafana/ via kustomize-generated ConfigMaps.
- server.yaml for the Go server (port 8080, UID 65532, smaller limits),
  image tag 2.0.0. The NetworkPolicy now admits Grafana to InfluxDB.
- ingress.yaml: IngressRoutes for car.stinnesbeck.com and Grafana
  (placeholder host car-grafana.stinnesbeck.com) with tls: {}, using
  Traefik's default certificate; the cert-manager Certificate is gone.
- secrets.example.yaml: drops the dashboard secrets, adds grafana-admin.
- AGENTS.md loses its Next.js block; SPECS.md describes the new setup.

The removal of web/ (the Next.js app) and of the stale .next/ cache
upstream had committed already landed in 51e6f6f, which was staged
together with the Go server by mistake.

Checked end to end in podman (Go server + InfluxDB 2.7.12 + Grafana
13.2.3): all 25 dashboard queries return the expected data, and the
dashboards were rendered with headless Chromium. Manifests validated
offline with kustomize and kubeconform. Nothing applied to a cluster.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki

k8s/server.yaml

@@ -1,5 +1,5 @@
-# The car server. One replica on purpose: the ABRP rate limit is kept in memory, and two
-# replicas would each forward to ABRP at the full rate.
+# The car server (Go). One replica on purpose: the ABRP rate limit is kept in memory, and
+# two replicas would each forward to ABRP at the full rate.
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -26,8 +26,8 @@ spec:
         - name: git-stinnesbeck-registry
       securityContext:
         runAsNonRoot: true
-        runAsUser: 10001
-        runAsGroup: 10001
+        runAsUser: 65532
+        runAsGroup: 65532
         seccompProfile:
           type: RuntimeDefault
       containers:
@@ -35,7 +35,7 @@ spec:
           image: git.stinnesbeck.com/nils/mg4-server:latest # pinned by kustomization.yaml
           ports:
             - name: http
-              containerPort: 3000
+              containerPort: 8080
           env:
             - name: INFLUX_URL
               value: http://influxdb.mg4.svc:8086
@@ -48,7 +48,7 @@ spec:
                 secretKeyRef:
                   name: influxdb-auth
                   key: admin-token
-          # INGEST_TOKEN, SESSION_SECRET, DASHBOARD_PASSWORD, ABRP_API_KEY, ABRP_USER_TOKEN.
+          # INGEST_TOKEN, ABRP_API_KEY, ABRP_USER_TOKEN, ABRP_MIN_INTERVAL_SECONDS.
           envFrom:
             - secretRef:
                 name: mg4-server
@@ -61,30 +61,19 @@ spec:
             httpGet:
               path: /v1/health
               port: http
-            initialDelaySeconds: 10
+            initialDelaySeconds: 5
             periodSeconds: 30
           resources:
             requests:
-              cpu: 50m
-              memory: 128Mi
+              cpu: 10m
+              memory: 32Mi
             limits:
-              memory: 512Mi
+              memory: 128Mi
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true
             capabilities:
               drop: ["ALL"]
-          volumeMounts:
-            # Next.js writes its fetch/image cache here; the rest of the filesystem is read-only.
-            - name: next-cache
-              mountPath: /app/.next/cache
-            - name: tmp
-              mountPath: /tmp
-      volumes:
-        - name: next-cache
-          emptyDir: {}
-        - name: tmp
-          emptyDir: {}
 ---
 apiVersion: v1
 kind: Service