Stop serving Grafana as anonymous admin on the public hostname

infra/helm/medical-chatbot/templates/observability-workloads.yaml

@@ -236,13 +236,21 @@ spec:
                 secretKeyRef:
                   name: {{ include "medical-chatbot.secretName" . }}
                   key: grafana-admin-password
+            # Anonymous access is a viewing convenience, never an admin
+            # bypass: this Grafana is reachable from the public internet
+            # through the same ingress as the app, so an anonymous Admin role
+            # hands strangers the datasource and dashboard APIs.
             - name: GF_AUTH_ANONYMOUS_ENABLED
-              value: {{ .Values.observability.grafana.anonymousAdmin | quote }}
+              value: {{ .Values.observability.grafana.anonymous.enabled | quote }}
             - name: GF_AUTH_ANONYMOUS_ORG_ROLE
-              value: Admin
+              value: {{ .Values.observability.grafana.anonymous.role | quote }}
+            # Never disabled. Hiding the login form alongside anonymous Admin
+            # left no way to authenticate as a real user at all.
             - name: GF_AUTH_DISABLE_LOGIN_FORM
-              value: {{ .Values.observability.grafana.anonymousAdmin | quote }}
+              value: "false"
             {{- if .Values.ingress.enabled }}
+            # Must be the hostname users actually arrive on, or Grafana's own
+            # redirects and asset links point at the wrong site.
             - name: GF_SERVER_ROOT_URL
               value: "https://{{ .Values.ingress.host }}/grafana/"
             - name: GF_SERVER_SERVE_FROM_SUB_PATH