Stop serving Grafana as anonymous admin on the public hostname

infra/helm/medical-chatbot/values.yaml

@@ -73,6 +73,11 @@ ingress:
   className: nginx
   annotations: {}
   host: duocthu.local
+  # Additional hostnames served by the same rules as `host`. Used during a
+  # cutover, when one release must answer to both the old and the new name.
+  # A host here is routed but gets no certificate unless it also appears in
+  # `tls` below — see the note in templates/ingress.yaml.
+  extraHosts: []
   tls: []
 
 postgres:
@@ -121,7 +126,12 @@ observability:
       port: 3000
       nodePort: null
     storage: 2Gi
-    anonymousAdmin: false
+    # Anonymous access, when enabled, must stay read-only. `role: Admin` on an
+    # internet-reachable Grafana exposes the datasource and dashboard APIs to
+    # anyone; the login form is always available for real admin access.
+    anonymous:
+      enabled: false
+      role: Viewer
     resources:
       requests: { cpu: 50m, memory: 128Mi }
       limits: { cpu: 500m, memory: 512Mi }