deploy: no local Prometheus + Grafana stack for laptop demos

[obchain]

Problem

deploy/compose/docker-compose.yml ships charon + alloy (sidecar -> Grafana Cloud). README explicitly states: "no local Prometheus or Grafana is deployed — the Grafana Cloud free tier is the visualisation surface".

For an operator without Grafana Cloud credentials there is no turnkey path to:

• scrape charon:9091,
• load deploy/grafana/charon.json,
• evaluate deploy/grafana/alerts.yaml rules,
• view live BSC pipeline behaviour on a laptop.

The stated goal in the v0.1 demo path (live BSC connection + Prometheus + Grafana on a laptop) cannot be satisfied with current deploy artefacts.

Impact

• Pre-merge demos require manual brew install prometheus grafana + manual datasource and dashboard wiring, which is undocumented and easy to misconfigure (wrong scrape target, wrong dashboard UID).
• New contributors cannot validate metrics changes locally without standing up Grafana Cloud trial accounts.
• Regression risk: panels can rot without anyone noticing because nobody runs the dashboard locally.

Fix

Add a self-contained local stack alongside the existing cloud-bound deploy:

• deploy/prometheus/prometheus.yml — scrape host.docker.internal:9091 (charon native on host) and charon:9091 (charon in compose), load deploy/grafana/alerts.yaml via rule_files:.
• deploy/grafana/provisioning/datasources/prometheus.yml — auto-provision Prometheus datasource pointing at the in-stack Prometheus.
• deploy/grafana/provisioning/dashboards/charon.yml — file provider that mounts deploy/grafana/charon.json into Grafana on startup so the dashboard is present before the first browser hit.
• deploy/compose/local-stack.yml — Prometheus 2.55 + Grafana 10.4 services on their own internal network. Grafana exposed on :3000, Prometheus on :9090. Anonymous Admin org role so demos require zero login. extra_hosts: host.docker.internal:host-gateway so the stack works on Linux Docker the same as on macOS.

Charon stays out of local-stack.yml so the operator can choose: native cargo run on host, OR the existing docker-compose.yml. Both are reachable from the local stack.

Acceptance

1. docker compose -f deploy/compose/local-stack.yml up -d -> Prometheus + Grafana healthy.
2. cargo run -- --config config/default.toml listen (separate terminal, native).
3. http://localhost:9090/targets shows charon job UP within 30 s.
4. http://localhost:3000/d/charon-v0 renders without manual import; scanner-block-rate panel non-empty within 60 s.
5. http://localhost:9090/api/v1/rules lists charon-availability rule group.
6. Existing deploy/compose/docker-compose.yml (Alloy -> Grafana Cloud) untouched and continues to work.

Severity

High — blocks the documented laptop demo path for any operator without Grafana Cloud credentials.