Stop serving Grafana as anonymous admin on the public hostname

.github/workflows/helm-chart.yml

@@ -93,6 +93,31 @@ jobs:
           expect /tmp/practice-app.yaml 'checksum/runtime-config:'
           expect /tmp/practice-app.yaml '- host: "readytochat.realvuxbaro.me"'
 
+          # The production hostname now lives on this cluster, routed and with
+          # its own certificate secret -- kept separate from the rehearsal
+          # hostname's so one renewal failure cannot take both names offline.
+          expect /tmp/practice-app.yaml '- host: "realvuxbaro.me"'
+          expect /tmp/practice-app.yaml 'secretName: realvuxbaro-tls'
+          expect /tmp/practice-app.yaml 'secretName: readytochat-tls'
+
+          # Grafana answers on that same public hostname. Anonymous access may
+          # be open, but never as Admin, never with the login form disabled,
+          # and its root URL must be the name users actually arrive on.
+          expect /tmp/practice-app.yaml 'value: "https://realvuxbaro.me/grafana/"'
+          refute /tmp/practice-app.yaml 'value: "Admin"'
+
+          # grep is line-oriented, so read the value on the line after each
+          # flag rather than trying to match the pair as one pattern.
+          for check in "GF_AUTH_ANONYMOUS_ORG_ROLE:Viewer" "GF_AUTH_DISABLE_LOGIN_FORM:false"; do
+            flag=${check%%:*}
+            want=${check#*:}
+            got=$(grep -A1 -- "$flag" /tmp/practice-app.yaml | grep -- 'value:' | tr -d ' "' | cut -d: -f2)
+            if [ "$got" != "$want" ]; then
+              echo "::error::$flag rendered as '$got', expected '$want'"
+              exit 1
+            fi
+          done
+
           # The app release must own neither data StatefulSet: PostgreSQL and
           # Qdrant belong to the data release, so an app-side sync failure or
           # prune can never delete the corpus or the query history. Only those