Make Grafana a link tile on Homepage, not a live widget (#155)

[nickvigilante]

Summary

Closes #155.

#155 set out to migrate Homepage's Grafana widget from basic-auth to a
least-privilege service-account token. Investigation showed that's
architecturally impossible on Grafana OSS:

Homepage's grafana widget makes a mandatory GET /api/admin/stats call
(if it errors, the whole widget errors). That endpoint is gated by Grafana
server admin — confirmed: it returns 200 only for the server-admin user.
Grafana OSS can't grant server-admin to a service account:

• isGrafanaAdmin: true at SA creation doesn't persist (GET drops it; admin/stats still 403s)
• an org-Admin SA token still gets 403
• the RBAC role-assignment API (fixed:*:reader) is Enterprise-only (all /api/access-control/* 404)

The only credential that satisfies the widget is a server-admin user —
root-on-Grafana sitting in the Homepage pod for a counts tile, below the
least-privilege bar every other widget meets.

Two side facts:

• The existing basic-auth widget was already dead — the configured grafana-user doesn't exist in Grafana (basic auth 401), so the tile errored regardless.
• A Viewer-scoped SA token can read the counts via non-admin endpoints (/api/search?type=dash-db, /api/datasources, /api/alertmanager/grafana/api/v2/alerts), but only Homepage's one-endpoint-per-tile customapi widget can consume them — which doesn't reproduce the 4-stat layout. Not worth the complexity for low-value counts.

So Grafana becomes a plain link tile.

Changes

• k8s/homepage/values.yaml — drop the grafana widget block and the HOMEPAGE_VAR_GRAFANA_USER/PASSWORD env; keep the href tile with a comment explaining why.
• k8s/homepage/external-secret.yaml — drop the grafana-user / grafana-password keys.
• k8s/homepage/secret.example.yaml — drop the grafana stanza, note the link-tile rationale.
• k8s/homepage/README.md — document the OSS server-admin limitation and the rejected Viewer-SA/customapi path.
• k8s/kube-prometheus-stack/README.md — replace the old step-7 "create a Viewer login" recipe with the link-tile reality; drop the homepage-user/homepage-password prereq fields.

Apply (gandalf, after merge)

git checkout main && git pull
flux reconcile kustomization homepage --with-source   # ESO drops the grafana-* Secret keys
helm upgrade homepage jameswynn/homepage -n homepage --version 2.1.0 -f k8s/homepage/values.yaml

Follow-up cleanup (not in this PR)

• Delete the now-unused homepage-widget Grafana service account.
• The BWS grafana-user / grafana-password entries and the BW vault Homelab Grafana homepage-user / homepage-password fields are now orphaned; prune when convenient.