Admin PR 18 added role-scoped observability links. PR 19 removed the catalogue section's vertical stretch and reduced sidebar group spacing without changing the palette, permissions or link target sizes. Both were merged to staging; merged commit 21b313c was deployed to the VPS after passing CI.

The first deployment attempt had been refused before execution. A subsequently authorised attempt completed: protected configuration backups and a stopped Grafana volume archive were created and archive readability checked. Only the console and Grafana were recreated; the existing ingress was reloaded through its supported file-based signal mechanism. No database migration was required.

Grafana now uses an authenticated HTTPS subpath on the existing admin origin. Its loopback-only host listener, credentials and persistent volume were retained. Anonymous access and self-signup remain disabled; cookies are secure. Loki and Alloy remain internal. The canonical Grafana deployment now includes both the base Compose file and its protected public-path override, recorded in the private operator inventory. Neither actual URLs nor private paths are recorded here.

Verification: 32 unit/database/HTTP tests, CI audit/build, browser role checks and screenshots in both themes on desktop/mobile passed. Live login/TLS/subpath and JavaScript assets passed; anonymous Grafana search and console observability were denied. The existing authenticated Operations dashboard and Loki datasource health passed using the existing operator credential without exposing it. Mobile API health remained OK. The live compact stylesheet and healthy console image were confirmed.

No production test staff, mobile users or Grafana accounts were created. Grafana still has independent authentication: a console administrator must have an explicitly authorised Grafana identity; console roles do not automatically grant Grafana server-administrator privileges.