fix: Final-Review-Feinschliff (DR-Kommentar korrigiert, SameSite-Pin, Grafana-Link-Hostname)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

create_pod_finance.sh

@@ -47,9 +47,10 @@ GRAFANA_PROVISIONING_DIR="$FINANCE_DIR/grafana/provisioning"
 GRAFANA_DASHBOARDS_DIR="$FINANCE_DIR/grafana/dashboards"
 
 # --- Secrets bootstrap -------------------------------------------------------
-# Secrets live under BIND_DIR (not the code checkout in FINANCE_DIR), so a
-# backup of BIND_DIR plus this script alone are sufficient for disaster
-# recovery. BIND_DIR must exist and be private before .env is written into it.
+# Secrets live under BIND_DIR (not the code checkout in FINANCE_DIR). For
+# disaster recovery you need BOTH: a backup of BIND_DIR (data + secrets) AND
+# the repo checkout ~/bin (this script, finance/ for the image build, Grafana
+# provisioning). BIND_DIR must exist and be private before .env is written.
 mkdir -p "$BIND_DIR" && chmod 700 "$BIND_DIR"
 
 ENV_FILE="$BIND_DIR/.env"
@@ -231,6 +232,7 @@ echo "Container '$API_CTR_NAME' started (rc=$?)"
 podman run -d --name "$GRAFANA_CTR_NAME" --pod "$POD_NAME" \
   -e GF_SECURITY_ADMIN_PASSWORD="$FB_PASSWORD" \
   -e GF_SECURITY_ALLOW_EMBEDDING=true \
+  -e GF_SECURITY_COOKIE_SAMESITE=lax \
   -e FINANCE_READ_PASSWORD \
   -v "$GRAFANA_PROVISIONING_DIR:/etc/grafana/provisioning:Z,ro" \
   -v "$GRAFANA_DASHBOARDS_DIR:/var/lib/grafana/dashboards:Z,ro" \

finance/app/templates/index.html

@@ -59,6 +59,6 @@
 <h2>Grafana-Dashboard</h2>
 <iframe class="grafana" src="http://{{ request.url.hostname or '127.0.0.1' }}:8097"></iframe>
 <p class="hint">Kein Diagramm sichtbar? Einmal in
-  <a href="http://127.0.0.1:8097" target="_blank">Grafana anmelden</a>
+  <a href="http://{{ request.url.hostname or '127.0.0.1' }}:8097" target="_blank">Grafana anmelden</a>
   (gleiches Passwort wie hier).</p>
 {% endblock %}