Fix Grafana bootstrap: grafana-cli --homepath + valid plugin version

Found on first boot (cloud-init errored, grafana-server never started):
- grafana-cli needs --homepath=/usr/share/grafana or it can't find config
  defaults; under set -e that aborted the whole bootstrap.
- pinned plugin version 2.18.2 doesn't exist (conflated with awswrangler's
  version) — grafana-athena-datasource latest is 3.2.0.

Verified by running the corrected bootstrap on the instance via SSM: plugin
installs, grafana-server active, /api/health 200, ALB target healthy.

NOTE: the running instance was repaired in-place (the user-data change updated
the launch template but did not replace the instance). The committed user-data
is now correct, so a fresh launch boots clean — a one-time clean instance
replacement should validate that before prod sign-off.

cdk/assets/grafana_userdata.sh

@@ -25,7 +25,9 @@ REPO
 dnf install -y grafana
 
 # --- Athena datasource plugin (pinned for reproducibility) ---
-grafana-cli --pluginsDir /var/lib/grafana/plugins plugins install grafana-athena-datasource "${PLUGIN_VERSION}"
+# --homepath is required or grafana-cli can't find its config defaults.
+grafana-cli --homepath=/usr/share/grafana --pluginsDir=/var/lib/grafana/plugins \
+  plugins install grafana-athena-datasource "${PLUGIN_VERSION}"
 
 # --- grafana.ini: behind the ALB at grafana.seahaven.com, kiosk-friendly ---
 cat >/etc/grafana/grafana.ini <<'INI'

cdk/cdk.json

@@ -12,6 +12,6 @@
     "grafanaPrivateSubnetIds": ["subnet-04e38c507e96f1926", "subnet-0a0b4fc6f296dfba5"],
     "grafanaDomain": "grafana.seahaven.com",
     "officeCidrs": ["47.21.61.4/32", "96.250.164.146/32"],
-    "athenaPluginVersion": "2.18.2"
+    "athenaPluginVersion": "3.2.0"
   }
 }