fix(pmm-fb): follow PMM's secrets directory to /srv/sep

sidecar/pmm-fb/README.md

@@ -115,27 +115,24 @@ curl -sk -H "Authorization: Bearer $TOKEN" https://127.0.0.1:8443/sep/api/apps/
   Nothing secret is committed; re-running keeps an existing `.env` and appends
   any slot it predates.
 - **PMM owns every SEP deployment secret.** With `PMM_ENABLE_SEP=1` it writes
-  six files into the `pmm-sep-secrets` volume, which pmm-server mounts at
-  `/srv/sep-secrets` and the side-car mounts read-only at `/run/secrets/sep`.
+  four files into the `pmm-sep` volume, which pmm-server mounts at
+  `/srv/sep` and the side-car mounts read-only at `/run/secrets/sep`.
   `SECRETS_DIR` points SEP at that directory and it reads each file as the
   canonical setting the filename names:
 
   | File | Written by | When |
   |---|---|---|
   | `SECRET_KEY` | the entrypoint | seconds after container start |
   | `SEP__DATABASE__PASSWORD`, `INVENTORY__DATABASE__PASSWORD`, `TASKS__DATABASE__PASSWORD` | the entrypoint | seconds after container start |
-  | `AUTH__PROVIDER__GRAFANA__SERVICE_ACCOUNT_TOKEN`, `PMM__API_KEY` | `grafana-sep`, a supervisord one-shot | after Grafana's first-boot migration |
 
-  None of the six reaches the side-car as environment, so none appears in
+  None of the four reaches the side-car as environment, so none appears in
   `docker inspect` or in the process environment. `SEP_NOMAD_ENDPOINT` is the
   one credential that does: PMM's stock `admin:admin`, a published default
   rather than a provisioned secret.
-- **The two-stage write is why `sep-sidecar` waits on
-  `condition: service_healthy`.** SEP builds its settings once, at process
-  start, and never re-reads them: a side-car released between the two stages
-  would come up with Grafana authentication permanently inert. pmm-server's
-  healthcheck gates on the current provisioning run having published both token
-  files, so health means the side-car can safely read everything.
+- **`sep-sidecar` waits on `condition: service_healthy`** because SEP builds its
+  settings once, at process start, and never re-reads them: a side-car released
+  before the files exist comes up with those settings permanently unset. Health
+  means the current provisioning run has published them.
 - **Group 0, not a matching uid.** The side-car runs as uid/gid 1001 and PMM
   writes the files mode 0640 owned by group `root` under a setgid `02770`
   directory. `group_add: ["0"]` is what makes them readable, and it keeps

sidecar/pmm-fb/bootstrap.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # Generate this harness's per-deployment secrets (.env). Idempotent: an existing
 # .env is kept, and any slot it predates is appended. PMM owns every remaining
-# SEP secret — it writes them into the pmm-sep-secrets volume, which the side-car
+# SEP secret — it writes them into the pmm-sep volume, which the side-car
 # reads as files; nothing secret reaches the side-car as environment.
 
 set -o nounset

sidecar/pmm-fb/compose.yaml

@@ -10,7 +10,7 @@
 # pmm-fb/README.md "Which image to pin".
 #
 # Run ./bootstrap.sh first: it generates the .env this file interpolates. PMM
-# owns every SEP deployment secret: it writes them into the pmm-sep-secrets
+# owns every SEP deployment secret: it writes them into the pmm-sep
 # volume, which the side-car reads through SECRETS_DIR, and it serves SEP under
 # its own /sep prefix. SEP's remaining settings come from the profile baked into
 # the image, with the per-deployment values below overriding it — environment
@@ -50,7 +50,7 @@ services:
     volumes:
       - pmm-data:/srv
       # The only volume crossing the boundary; pmm-data stays PMM's alone
-      - pmm-sep-secrets:/srv/sep-secrets
+      - pmm-sep:/srv/sep
     networks:
       - sep-pmm
 
@@ -83,7 +83,7 @@ services:
       - "127.0.0.1:9001:9001" # inventory API
       - "127.0.0.1:9002:9002" # tasks API
     volumes:
-      - pmm-sep-secrets:/run/secrets/sep:ro
+      - pmm-sep:/run/secrets/sep:ro
     networks:
       - sep-pmm
 
@@ -143,8 +143,8 @@ networks:
 volumes:
   pmm-data:
   # Project-scoped deliberately: an unqualified name: would collide with a real
-  # PMM install's pmm-sep-secrets volume on the same host
-  pmm-sep-secrets:
+  # PMM install's pmm-sep volume on the same host
+  pmm-sep:
   sep-mysql-data:
   sep-mysql-pmm-config:
   sep-mysql-nomad: