feat(observability): add diagnostic dashboards (#27)

README.md

@@ -84,10 +84,10 @@ directory leases, authenticated join attempts, LiteNetLib mediator, caller-owned
 SDK coordination, typed connection outcomes, thin public-SDK diagnostic client,
 deterministic NAT topology harness, hostile-input controls,
 observability/operator surface, secure single-active Linux deployment, and
-numeric capacity/resilience gates, and reproducible signed release pipeline are
-implemented. Consumer pilots and final production-readiness gates remain in progress;
-participating games must not treat the current repository as a finished production
-service until those gates land.
+numeric capacity/resilience gates, reproducible signed release pipeline, consumer
+pilot integrations, and production-readiness decision framework are implemented.
+Deployment-specific external canaries and optional roadmap follow-ups remain;
+participating games must not treat a checkout alone as production approval.
 
 The ratified v1 boundaries, trust decisions, privacy rules, safety budgets, and
 threat model are indexed in [the architecture documentation](docs/architecture/README.md).
@@ -100,6 +100,8 @@ defined in [hostile-input and overload protection](docs/security/abuse-protectio
 Health semantics, bounded telemetry, alerting, audit privacy, and the authenticated
 operator controls are defined in the
 [observability and operator runbook](docs/operations/observability-and-operator-runbook.md).
+The optional public session diagnostic and the private provisioned Grafana stack
+are described in [diagnostic dashboards](docs/operations/diagnostic-dashboards.md).
 Concrete detect/contain/recover/verify procedures are in the
 [incident and change runbooks](docs/operations/incident-runbooks.md).
 The pinned non-root container, production topology, graceful drain, Linux