feat(grafana-metric-gateway): slice 1 — backend gateway transport

Route all prometheus widget queries through Grafana /api/ds/query instead of
direct Prom HTTP. PrometheusConfig: drop base_url, add grafana_url +
datasource_uid; secret grafana_api_key (required). PrometheusWidgetSource →
MetricSource with _gateway_query POST method. normalize_grafana_frames
recovered from 65bae95 + shared _dedup_label helper. Gateway-path status
check. Startup old-config validation. CHANGELOG migration note. All adapter
tests rewritten for POST /api/ds/query + Grafana frames mock. Backend: 331
pytest pass, ruff clean. Frontend: build green (unchanged in S1).

CHANGELOG.md

@@ -4,6 +4,19 @@ All notable changes to Manage. Breaking changes are marked with **BREAKING**.
 
 ## [Unreleased]
 
+### **BREAKING** — Prometheus queries now route through Grafana gateway
+
+- The `prometheus` service config changed: `base_url` is replaced by
+  `grafana_url` + `datasource_uid`, and the `api_key` secret is replaced by
+  `grafana_api_key` (a Grafana service account token or API key with read
+  access to the Prometheus datasource). All metric widget queries (`chart`,
+  `gauge`, `mean`, `metric`) now issue `POST {grafana_url}/api/ds/query`
+  instead of direct Prometheus HTTP calls.
+- **Migration:** Reconfigure existing `prometheus` services — replace
+  `base_url` with `grafana_url` (your Grafana instance URL), add the
+  `grafana_api_key` secret, and optionally set `datasource_uid` (defaults
+  to `"prometheus"`).
+
 ### Added — Direct Prometheus charting
 
 - **Prometheus is now the direct source for in-app charts.** New widget kinds