Grafana's read-only InfluxDB token is made automatically

The read-only token for Grafana needed a manual influx command and a
Secret. InfluxDB generates every token but the admin one and ignores a
chosen value (tested on 2.7.12), so it cannot be preset in a Secret.

Instead an init container in the Grafana pod creates it at every start
with the admin token, deletes the one from the previous start, and
writes only the read-only token to a memory-backed volume; the
provisioned datasource reads it with $__file{/run/influx/token}. The
Grafana process never sees the admin token. The grafana-influx Secret
is gone from the template and the README.

Tested in podman: InfluxDB 2.7.12, the script run twice as the Grafana
user (the old token is replaced, not piled up), and Grafana 13.2.3
reporting the datasource healthy with the file-based token.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki

k8s/grafana/datasources.yaml

@@ -1,5 +1,6 @@
-# Provisioned InfluxDB datasource. URL and token come from the Grafana container's
-# environment (INFLUX_URL, INFLUX_TOKEN), so no credential is stored in this file.
+# Provisioned InfluxDB datasource. The URL comes from the environment (INFLUX_URL); the token is
+# a read-only one the Grafana pod's init container writes to /run/influx/token at each start
+# (grafana.yaml). No credential is stored in this file.
 apiVersion: 1
 datasources:
   - name: InfluxDB (mg4)
@@ -14,4 +15,4 @@ datasources:
       organization: mg4
       defaultBucket: mg4
     secureJsonData:
-      token: $INFLUX_TOKEN
+      token: $__file{/run/influx/token}