Monitor: Grafana auth proxy session fix and nginx login bypass.

Use ac_crash_sess shared session, allow password reset without auth_request,
update grafana.ini template and alert rules.

Co-authored-by: Cursor <cursoragent@cursor.com>

monitoring/cast04/grafana.ini

@@ -53,6 +53,7 @@ enabled = true
 header_name = X-WEBAUTH-USER
 header_property = username
 auto_sign_up = true
+enable_login_token = true
 # Trust X-WEBAUTH-USER only from cluster BE nginx (cast01–03):
 whitelist = 10.7.16.236,10.7.16.237,10.7.16.238
 # Sync roles from header (optional, set X-WEBAUTH-ROLE in nginx if needed):
@@ -66,7 +67,13 @@ enabled = false
 enabled = true
 
 [smtp]
-enabled = false   # Grafana own SMTP not needed; alertmanager handles mail
+enabled = true
+host = smtp.gmail.com:587
+user = @MSMTP_USER@
+password = @MSMTP_PASS@
+from_address = @MSMTP_FROM@
+from_name = Android Cast Monitoring
+startTLS_policy = MandatoryStartTLS
 
 [log]
 mode = file