e2e: assigned sonarr + grafana prove the two runtime config paths (ADR 0051/0052)

assigned-sonarr proves the Servarr detection path: the runtime discovers its API
key from the app's config.xml and serves its tools. assigned-grafana proves the
settings path: the operator states URL and token as settings, the mesh merges them
into the module's config file, and the runtime serves from that with nothing in the
manifest. Both green.

Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

scenarios/grafana-node.yml

@@ -0,0 +1,28 @@
+# One machine that becomes a mesh and assigns itself grafana's tool runtime, configured by settings.
+#
+# plex/sonarr prove a runtime that self-detects its credential; this proves the other half of the
+# config story (novox/hq ADR 0051 + 0052): the operator states grafana's URL and token as the
+# assignment's settings, the mesh merges them into the config file the runtime reads, and the
+# runtime registers and serves grafana's tools from that — no credential baked into the manifest.
+scenario: grafana-node
+
+segments:
+  hosting:
+    kind: public
+    cidr: [192.0.2.0/24]
+
+machines:
+  anchor:
+    at: { segment: hosting, address: [192.0.2.10] }
+    inbound: allow
+    memory: 3GiB
+    cpus: 2
+
+images:
+  - postgres:17-alpine
+  - cloudamqp/lavinmq:latest
+  - mesh-control:development
+  - mesh-runtime-grafana:development
+
+place:
+  all: [host, runtime]