Grafana: match Google logins to pre-provisioned users by email

Grafana 9.3+ won't look up an OAuth login by email, so a Google sign-in for
the API-created admin (no prior Google-auth linkage) tried to auto-create the
user and hit allow_sign_up=false ("signup is disabled"). Enable
oauth_allow_insecure_email_lookup so the login matches the existing user by
its Google-verified email. Single provider + verified email = no takeover risk.

docker-compose.yml

@@ -51,6 +51,13 @@ services:
       GF_AUTH_GOOGLE_TOKEN_URL: "https://oauth2.googleapis.com/token"
       GF_AUTH_GOOGLE_API_URL: "https://openidconnect.googleapis.com/v1/userinfo"
       GF_AUTH_GOOGLE_ALLOW_SIGN_UP: "false"
+      # Match a Google login to a PRE-PROVISIONED user by email (the admin created
+      # via the API has no prior Google-auth linkage). Without this, Grafana 9.3+
+      # won't look up by email and instead tries to auto-create the user — which
+      # allow_sign_up=false then rejects ("signup is disabled"). Safe here: Google
+      # verifies email ownership and it's the only OAuth provider, so there's no
+      # cross-provider takeover vector the "insecure" name warns about.
+      GF_AUTH_OAUTH_ALLOW_INSECURE_EMAIL_LOOKUP: "true"
     volumes:
       - ./grafana/provisioning:/etc/grafana/provisioning:ro
       - ./grafana/dashboards:/var/lib/grafana/dashboards:ro