Required approvals on environments is a Premium/Ultimate feature.
Keep only when:manual as the single gate for terraform-destroy.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Bind the job to the 'destroy-production' environment so GitLab blocks
execution until an authorized user approves it in the UI, in addition
to the existing when:manual gate.

Configure in GitLab: Settings > CI/CD > Protected Environments
  environment: destroy-production, required approvals: 1

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- New 'destroy' stage at the end of the pipeline
- terraform-destroy job is when:manual so it only runs on explicit
  click in GitLab UI; allow_failure:false blocks accidental continuation
- Extract .terraform_setup anchor (image + before_script with init)
  shared between 'infra' and 'terraform-destroy' to avoid duplication
- Update variables comment to reflect container.admin and Terraform
  backend variables

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- Section 5: explain the CORS problem that drove API_BASE='', show
  before/after fetch URLs, document the Vite proxy as the local dev
  equivalent
- Section 6: split into 6.1 (route/integration tests) and 6.2 (unit
  tests), describe what each individual test guarantees about route
  behavior and metric instrumentation

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- Frontend: document API_BASE relative URL approach and Vite dev proxy
- Backend: add section 6 covering Jest/supertest test suite (9 tests)
- Repository structure: add metrics.js, __tests__/, k8s/monitoring/,
  infra/iam.tf to the tree
- Pipeline: add deploy-monitoring job, GRAFANA_ADMIN_PASSWORD variable,
  update SA role to roles/container.admin
- Observability: replace basic GCP logging section with full section 9
  covering Prometheus/Grafana stack, instrumented metrics, dashboard
  panels with PromQL, Grafana access via ExternalName service

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

rate()/$__rate_interval can return no data on stat panels when the
calculated interval doesn't align with scrape points. Switch to
increase()/$__range to match the same approach used by the other
stat panels and reliably capture all errors in the selected window.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Use $__rate_interval instead of fixed 5m, sum() to aggregate across
instances, and 'or on() vector(0)' so the numerator falls back to 0
when no 5xx series exist instead of leaving the panel blank.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Counters displayed with increase() return floats due to Prometheus
interpolation. Force integer display on the three total panels.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

challenges_updated_total has a status label, so increase() alone
returns one series per status value. Wrap with sum() to collapse
all statuses into a single total for the stat panel.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Replace raw counter with increase(...[$__range]) on the three stat
panels so they reflect events within the time window chosen in Grafana
instead of the all-time cumulative value.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Add stat panels for total created/deleted/updated challenges and a
full-width timeseries showing created vs deleted per period using
increase() over $__rate_interval.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>