Grafana's read-only InfluxDB token is made automatically

The read-only token for Grafana needed a manual influx command and a
Secret. InfluxDB generates every token but the admin one and ignores a
chosen value (tested on 2.7.12), so it cannot be preset in a Secret.

Instead an init container in the Grafana pod creates it at every start
with the admin token, deletes the one from the previous start, and
writes only the read-only token to a memory-backed volume; the
provisioned datasource reads it with $__file{/run/influx/token}. The
Grafana process never sees the admin token. The grafana-influx Secret
is gone from the template and the README.

Tested in podman: InfluxDB 2.7.12, the script run twice as the Grafana
user (the old token is replaced, not piled up), and Grafana 13.2.3
reporting the datasource healthy with the file-based token.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki

SPECS.md

@@ -109,6 +109,12 @@ tyre pressures, GPS (lat, lon, elevation, heading) and the is_* flags. It does *
   INGEST_TOKEN) into git and pushed it. Commit amended and force-pushed; both values regenerated in
   the now gitignored `k8s/secrets.yaml` (since moved to `k8s/secrets/secrets.yaml`, outside
   `kubectl apply -f k8s/`). Filled-in secrets live only there from now on.
+- 2026-10-18 — Grafana's read-only InfluxDB token without a manual step: an init container in
+  the Grafana pod creates it with the admin token at every start, deletes the previous one and
+  leaves only the read-only token in a memory volume; the datasource reads it with
+  `$__file{/run/influx/token}`. InfluxDB ignores chosen token values (tested), so it cannot come
+  from the Secret. The `grafana-influx` Secret is gone. Tested in podman: InfluxDB 2.7.12, the
+  script as the Grafana user (twice: rotates, no pile-up), Grafana 13.2.3 datasource healthy.
 - 2026-10-18 — App 2.16.0, server 2.6.0: over-the-air updates from this repository. `publish-car`
   creates the pre-release `car-<version>` on the private forge with the APK and its `.sha256`;
   the server relays releases and attachments to the car (`/v1/app/…`, read with a read-only