grafana: add dashboards and fix permissions

- Change default OIDC role from Viewer to Editor for Explore access
- Add declarative dashboard provisioning
- Add node-exporter dashboard (CPU, memory, disk, load, network, I/O)
- Add Loki logs dashboard with host/job filters

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

services/grafana/default.nix

@@ -28,8 +28,8 @@
         email_attribute_path = "email";
         login_attribute_path = "preferred_username";
         name_attribute_path = "name";
-        # Map admins group to Admin role, everyone else to Viewer
-        role_attribute_path = "contains(groups[*], 'admins') && 'Admin' || 'Viewer'";
+        # Map admins group to Admin role, everyone else to Editor (for Explore access)
+        role_attribute_path = "contains(groups[*], 'admins') && 'Admin' || 'Editor'";
         allow_sign_up = true;
       };
     };
@@ -53,6 +53,19 @@
         }
       ];
     };
+
+    # Declarative dashboards
+    provision.dashboards.settings = {
+      apiVersion = 1;
+      providers = [
+        {
+          name = "homelab";
+          type = "file";
+          options.path = ./dashboards;
+          disableDeletion = true;
+        }
+      ];
+    };
   };
 
   # Vault secret for OAuth2 client secret