Add PostgreSQL datasource to Grafana with read-only user

- Create grafana_reader role with SELECT-only access on all schemas
- Init script runs on postgres first boot (docker-entrypoint-initdb.d)
- Grafana PostgreSQL datasource provisioned with read-only credentials
- Enables SQL queries in dashboards (user count, routes, etc.)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

infrastructure/postgres/init-grafana-user.sql

@@ -0,0 +1,32 @@
+-- Read-only user for Grafana dashboards
+-- Password is set via: ALTER ROLE grafana_reader PASSWORD '<from SOPS>'
+-- Run by cd-infra deploy script after container start
+
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = 'grafana_reader') THEN
+    CREATE ROLE grafana_reader WITH LOGIN;
+  END IF;
+END
+$$;
+
+GRANT CONNECT ON DATABASE trails TO grafana_reader;
+GRANT USAGE ON SCHEMA public TO grafana_reader;
+GRANT SELECT ON ALL TABLES IN SCHEMA public TO grafana_reader;
+ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO grafana_reader;
+
+-- Also grant on planner/journal schemas if they exist
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM information_schema.schemata WHERE schema_name = 'planner') THEN
+    GRANT USAGE ON SCHEMA planner TO grafana_reader;
+    GRANT SELECT ON ALL TABLES IN SCHEMA planner TO grafana_reader;
+    ALTER DEFAULT PRIVILEGES IN SCHEMA planner GRANT SELECT ON TABLES TO grafana_reader;
+  END IF;
+  IF EXISTS (SELECT 1 FROM information_schema.schemata WHERE schema_name = 'journal') THEN
+    GRANT USAGE ON SCHEMA journal TO grafana_reader;
+    GRANT SELECT ON ALL TABLES IN SCHEMA journal TO grafana_reader;
+    ALTER DEFAULT PRIVILEGES IN SCHEMA journal GRANT SELECT ON TABLES TO grafana_reader;
+  END IF;
+END
+$$;