Add scoped Grafana and Prometheus access for deployed MCP servers

Follow-up to #75.

Tenant/user dashboards should eventually link to observability views for the MCP servers a user or team owns, but direct access to the current `/grafana` and `/prometheus` surfaces is not safe because those tools are cluster-wide in the current stack and do not provide tenant-aware authorization here.

## Desired behavior

- Users can open Grafana/Prometheus views for only MCP servers deployed in namespaces they own or team namespaces they belong to.
- Direct observability links do not expose metrics for other users, teams, namespaces, or platform components.
- Links are available from the user dashboard and/or per-server analytics page once safe scoping exists.

## Possible approaches

- Add a platform API proxy for Prometheus queries that validates the authenticated principal against the requested namespace/server before querying Prometheus.
- Generate Grafana dashboard URLs with namespace/server variables only after the platform verifies the caller can read that server.
- Add auth-aware Grafana integration or per-tenant folders/datasources if that becomes part of the deployment model.

## Acceptance criteria

- Normal users cannot access cluster-wide Grafana or Prometheus data.
- Server-side authorization enforces namespace/team ownership for every observability query or link.
- UI links are shown only for servers the principal can read.
- Automated tests cover cross-tenant denial.
- Documentation explains the difference between admin observability and scoped user observability.