Sync Grafana dashboards with pkg/metrics

[awlx]

Problem

The checked-in dashboards had drifted from pkg/metrics.

Three panel targets queried measurements that no longer exist and rendered as empty panels:

Stale query	Actual metric
packetyeeter_baseline_anomalies	packetyeeter_baseline_anomalies_total
packetyeeter_baseline_stats.calibrated_asns	packetyeeter_baseline_calibrated_asns
packetyeeter_ml_stats.sample_count	packetyeeter_ml_predictions_total

57 of the registered metrics were not graphed anywhere. That included the entire sustained-download subsystem (#79), the enforcement kill-switch, and every queue depth/drop gauge — exactly the series an operator needs during a staged rollout to tell "detection is quiet" apart from "detection is not running".

Changes

Fixed the three stale targets and added rows covering the rest:

• Sustained Download Detection
• Enforcement Safety
• Pipeline Backpressure
• Attack Campaigns & Carpet Bombing
• Clock Skew & Payload Entropy
• ML & AI Engine Health
• Protocol Rates, SPOE & Reputation

Both dashboards now cover every metric registered in pkg/metrics plus the pkg/analyzer/reputation gauges. grafana-dashboard.json goes 77 → 123 panels, grafana-dashboard.influx.json 28 → 38. No pre-existing panel or query was dropped (verified against HEAD; the only three removed targets are the stale ones above).

Privacy is unchanged

Panels backed by per-IP, per-JA4H, or per-user-agent series aggregate those labels away, so the shared dashboards still never render a client address:

• packetyeeter_ai_detections_by_ip_total is summed inside a subquery, so the derivative is still taken per-series but the ip tag never reaches the panel.
• packetyeeter_threat_intel_info and packetyeeter_ai_recent_detections are reduced to series counts.
• packetyeeter_clock_skew_ppm and packetyeeter_payload_entropy_bits render as aggregate averages.
• packetyeeter_ja4db_user_agent_hits_total groups by fingerprint/match type only, never the UA string.
• packetyeeter_reputation_score is averaged per entity type, never per key.

All of these are gated behind -enable-high-cardinality-metrics upstream and stay empty without it; panel descriptions say so.

Layout

Repacked gridPos in both files. The main dashboard had 18 overlapping panel rectangles and the overview had 2, which Grafana silently reflowed on import — so the checked-in layout did not match what operators actually saw. Panels now also carry unique ids (48 previously had none).

Schema version

The files stay in the classic schema V1 format. Schema V2 was considered and rejected: it is experimental in Grafana 12.0–12.2, gated behind dashboardNewLayouts, and V2 dashboards cannot be viewed at all without that toggle, so shipping V2 would break import for most users. Importing V1 into an instance that does have the toggle on fails with Annotations is not an array; that's now documented in docs/observability.md along with the fix (import with the toggle off).

Also updated docs/observability.md, which previously stated the campaign panels were intentionally left out of the dashboard JSON.

Validation

• make portable-test — pass
• Coverage diff of pkg/metrics vs both dashboards: 0 stale refs, 0 uncovered metrics
• JSON parses; 0 gridPos overlaps; unique panel ids; balanced quotes/parens in all 218 targets
• git diff --check clean

No Go code changed, so no Linux/eBPF validation was required. Dashboard-only change; nothing here alters detection or enforcement behavior.