Expose production Grafana through router /grafana

Configure the live /home/deploy/router stack on router.kaukus.no so https://router.kaukus.no/grafana redirects correctly and serves Grafana login/assets/API through Caddy. Preserve Grafana authentication and unrelated service configuration. Back up changed files, persist the Caddy configuration in Compose, validate before deployment, and verify public routing and existing dashboard health. Scope is live server configuration only; no repository commit requested. Deployed: /home/deploy/router/Caddyfile is copied from the running dashboard image and bind-mounted read-only via docker-compose.yml. Caddy redirects exact /grafana to /grafana/ (308), and proxies /grafana/* without stripping the prefix to grafana:3000. Grafana root URL is https://router.kaukus.no/grafana/ with serve_from_sub_path enabled. Existing login and published port 3000 are unchanged. Backups: docker-compose.yml.before-grafana-20261028T174853Z and Caddyfile.before-grafana-20261028T174853Z. Compose config and Caddy validate pass. Recreated only grafana and cloud-dashboard, with no image pulls. Public HTTPS checks pass: /grafana 308, /grafana/ 302 to /grafana/login, login HTML 200, sampled CSS/JS assets 200 with correct types, Grafana health/database OK, unauthenticated /grafana/api/user 401, dashboard root 200 and /health 200 ok. Other services remained running. Initial dashboard recreation unintentionally selected an older local latest image instead of the previously running digest. User reported the regression; immediately restored and pinned the exact original dashboard digest cr.kaukus.no/kaukus/cloud-dashboard@sha256:eb5fde36604ef46b9513b5212272aa99093c48d2d385afd142b941486a7b952e in Compose and recreated only cloud-dashboard. Verified container image ID exactly matches the original, public dashboard HTML byte-matches /srv/index.html in that container, and dashboard root, router health, Grafana login and Grafana health all return 200. Grafana routing remains active. Additional Compose backup: docker-compose.yml.before-dashboard-image-restore. No browser or authenticated dashboard test performed. Mounted Caddyfile is now the server's override and must be reconciled with future image routing changes.