grafana-bridge: route via grafana subdomain to bypass WAF challenge

New subdomains get Cloudflare WAF managed challenges which block browser
fetch() calls. Instead, mount the bridge routes at /grafana-bridge/ so
they're reachable via grafana.westernformularacing.org (ZT Access protected)
using path-based tunnel ingress routing.

Security bonus: only ZT-authenticated users can reach the bridge.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: wfr-data-acquisition

installer/grafana-bridge/server.js

@@ -103,7 +103,11 @@ function buildPanel(signalName, index) {
   };
 }
 
-app.post("/api/grafana/create-dashboard", async (req, res) => {
+// Routes are mounted at both /api/grafana (direct) and /grafana-bridge/api/grafana
+// (path-based via grafana.westernformularacing.org tunnel to avoid WAF challenges).
+const router = express.Router();
+
+router.post("/api/grafana/create-dashboard", async (req, res) => {
   const { signals } = req.body;
 
   if (!signals || !Array.isArray(signals) || signals.length === 0) {
@@ -193,14 +197,18 @@ app.post("/api/grafana/create-dashboard", async (req, res) => {
 });
 
 // Health check
-app.get("/api/grafana/health", (_req, res) => {
+router.get("/api/grafana/health", (_req, res) => {
   res.json({
     status: "ok",
     grafana: GRAFANA_EXTERNAL_URL,
     tokenConfigured: !!GRAFANA_API_TOKEN,
   });
 });
 
+// Mount at root (direct port 3001 access) and under /grafana-bridge (via grafana subdomain tunnel)
+app.use("/", router);
+app.use("/grafana-bridge", router);
+
 const PORT = process.env.PORT || 3001;
 app.listen(PORT, () => {
   console.log(`Grafana bridge listening on port ${PORT}`);