Stop serving Grafana as anonymous admin on the public hostname

infra/helm/medical-chatbot/values-practice.yaml

@@ -55,18 +55,37 @@ aiService:
 
 observability:
   grafana:
-    # Practice-only convenience: the rehearsal cluster is a throwaway box and
-    # Grafana sits behind the same ingress host. Never set this on production.
-    anonymousAdmin: true
+    # Dashboards stay open so a demo needs no credentials, but read-only: this
+    # Grafana answers on the public production hostname, and it previously ran
+    # anonymous *Admin* with the login form disabled — which handed the
+    # datasource and dashboard APIs to anyone who found the URL, and left no
+    # way to sign in as a real admin either.
+    anonymous:
+      enabled: true
+      role: Viewer
 
 ingress:
   enabled: true
   className: traefik
-  host: readytochat.realvuxbaro.me
+  # Primary, not merely first in a list: `ingress.host` is what Grafana's
+  # GF_SERVER_ROOT_URL is built from, so it must be the name users arrive on.
+  # `realvuxbaro.me` moved here from the Compose host on 2026-08-17 — routed
+  # first and certificated only once its A record pointed at this cluster,
+  # because cert-manager solves HTTP-01 and the challenge could not reach here
+  # before that.
+  host: realvuxbaro.me
+  # The rehearsal name is kept so existing links and bookmarks still resolve.
+  extraHosts:
+    - readytochat.realvuxbaro.me
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-prod
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
+  # Separate secrets per hostname: a renewal failure on one name must not take
+  # the other offline.
   tls:
     - hosts:
         - readytochat.realvuxbaro.me
       secretName: readytochat-tls
+    - hosts:
+        - realvuxbaro.me
+      secretName: realvuxbaro-tls