Observability

Tip: restrict Grafana via auth/VPN if exposed.