fix(infra): harden grafana permissions and document recovery

- Why:
  - students hit permission denied after pull and grafana restart-loop with readonly db
- What:
  - run grafana as default non-root user
  - mount provisioning directory as read-only
  - add troubleshooting for git permission issues and grafana volume reset
  - normalize file modes for data jsonl and docs/DE-task.md to 100644
- Check:
  - docker compose config
  - docker compose up -d grafana
  - curl -u admin:admin http://localhost:3000/api/health

docker-compose.yml

@@ -193,14 +193,13 @@ services:
 
   grafana:
     image: grafana/grafana:11.5.2-ubuntu
-    user: root
     depends_on:
       - prometheus
     ports:
       - 3000:3000
     volumes:
       - grafana_lib:/var/lib/grafana
-      - ./configs/grafana/provisioning/:/etc/grafana/provisioning/
+      - ./configs/grafana/provisioning/:/etc/grafana/provisioning/:ro
     # container_name: grafana
     # hostname: grafana
     restart: unless-stopped