Add Grafana deploy annotations to all CD workflows

Posts an annotation to Grafana after each successful deploy, tagged
with "deploy" and the service name. Annotations appear as vertical
markers on dashboards, making it easy to correlate deploys with
metric changes.

Uses GRAFANA_SERVICE_TOKEN from SOPS secrets — must be added via
sops infrastructure/secrets.infra.env. Gracefully skips if the
token is not configured.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.github/workflows/cd-apps.yml

@@ -110,3 +110,13 @@ jobs:
             # Clean up
             docker image prune -af
             docker compose ps
+
+            # Annotate deploy in Grafana
+            GRAFANA_TOKEN=$(grep GRAFANA_SERVICE_TOKEN app.env | cut -d= -f2-)
+            if [ -n "$GRAFANA_TOKEN" ]; then
+              docker compose exec -T grafana wget -q -O /dev/null \
+                --header="Authorization: Bearer $GRAFANA_TOKEN" \
+                --header="Content-Type: application/json" \
+                --post-data='{"text":"Deploy '${{ github.sha }}'","tags":["deploy","apps"]}' \
+                http://localhost:3000/api/annotations || true
+            fi