feat: add browser-based SSO authentication

[solganik]

Add chromedp-based browser login flow that opens a real browser window for SSO authentication, captures the grafana_session cookie, and persists it to disk. Includes automatic re-authentication on 401 responses via a custom http.RoundTripper middleware.

New files:

• auth/browser.go: chromedp browser login with persistent Chrome profile
• auth/session_store.go: cookie persistence to ~/.config/mcp-grafana/
• auth/transport.go: SessionAuthTransport with auto 401 re-login

Modified:

• cmd/mcp-grafana/main.go: --browser-auth CLI flag
• mcpgrafana.go: wire browser auth transport into Grafana client

---

Note

High Risk
Introduces cookie-based authentication with automated browser login and persistence, and injects it into all Grafana HTTP traffic; mistakes here could leak sessions or break auth across requests. Also adds chromedp-based local rendering and expands query/deeplink generation logic, increasing dependency and behavioral surface area.

Overview
Adds browser-based SSO authentication as an alternative to API tokens: a new auth package drives a chromedp login flow, captures the grafana_session cookie, persists it to ~/.config/mcp-grafana/sessions.json, and injects/refreshes it via a SessionAuthTransport that auto re-logins on 401 (enabled via --browser-auth or GRAFANA_AUTH_BROWSER).

Expands tooling around dashboards and navigation: get_dashboard_panel_queries now supports panelId filtering, row-nested panels, multi-datasource query extraction, and optional template variable substitution with processedQuery/requiredVariables; generate_deeplink now builds full Explore left state (including queries and embedded time range) and can auto-resolve dashboard datasource template variables from a provided datasourceUid.

Adds render_panel_image_local, a new headless-Chrome screenshot renderer that uses the stored SSO session (no Grafana Image Renderer plugin), and wires it into rendering tools. Updates transports to ensure OrgID is consistently applied and adds/updates unit/integration tests, plus new chromedp dependencies and changelog entry for 0.11.3.

^{Written by Cursor Bugbot for commit 0db86dc. This will update automatically on new commits. Configure here.}

[cla-assistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 3 committers have signed the CLA.

✅ sd2k
❌ ataran-dev
❌ solganik
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is ON, but it could not run because the branch was deleted or merged before autofix could start.}

[cursor]

Duplicate variable substitution logic across two functions

Low Severity

The new substituteVariables in dashboard_helpers.go and the existing substituteTemplateVariables in run_panel_query.go both replace the same three Grafana template variable patterns (${varname}, $varname, [[varname]]) with different implementations. The new version additionally handles ${varname:option} but otherwise serves the same purpose. This duplication increases maintenance burden and risks inconsistent behavior.

Additional Locations (1)

• tools/run_panel_query.go#L251-L268