feat(mcp-catalog): add Grafana Cloud MCP server

Vendor-hosted remote MCP at https://mcp.grafana.com/mcp over Streamable
HTTP with native OAuth 2.1 + Dynamic Client Registration -- the same
transport/auth shape as the existing datadog and sentry catalog entries,
handled by Hermes's MCP client + mcp_oauth_manager.

Exposes Prometheus/Loki/Tempo/Pyroscope queries, dashboards, datasources,
alerting, incidents, and Grafana Assistant investigations, user-scoped to
the operator's Grafana RBAC. This is the hosted Grafana Cloud MCP, not the
self-run OSS mcp-grafana binary; post_install points self-hosted users to
the OSS server.

Source: https://grafana.com/docs/grafana-cloud/ai-tools/mcp-servers/cloud-mcp/

optional-mcps/grafana/manifest.yaml

@@ -0,0 +1,46 @@
+# Nous-approved MCP catalog entry.
+# Presence in this directory = approval. Merged via PR review.
+manifest_version: 1
+
+name: grafana
+description: >-
+  Query metrics, logs, dashboards, alerts, and incidents from Grafana Cloud.
+source: https://grafana.com/docs/grafana-cloud/ai-tools/mcp-servers/cloud-mcp/
+
+# Grafana Cloud's hosted remote MCP (URL-only — Hermes never spawns a local
+# process for this entry). Native OAuth 2.1 + Dynamic Client Registration over
+# Streamable HTTP; Hermes's MCP client + mcp_oauth_manager handle discovery,
+# PKCE, token exchange, and refresh. OAuth is user-scoped to your Grafana RBAC.
+#
+# Note: this is the *hosted* Grafana Cloud MCP server, not the self-run OSS
+# `mcp-grafana` binary (which authenticates with a service account token and
+# supports self-hosted Grafana). Self-hosted users should configure that
+# manually per https://github.com/grafana/mcp-grafana.
+transport:
+  type: http
+  url: https://mcp.grafana.com/mcp
+
+auth:
+  type: oauth
+
+# Composer-suggestion triggers (desktop brand pills).
+suggest:
+  keywords:
+    - grafana
+    - promql
+    - logql
+    - observability
+    - dashboard
+  hosts:
+    - grafana.net
+    - grafana.com
+
+post_install: |
+  On first connection Hermes opens a browser to authorize with Grafana Cloud
+  (or run `hermes mcp login grafana`). During authorization you'll enter your
+  Grafana Cloud stack URL (https://<your-stack>.grafana.net) and choose read
+  or read+write access, then approve. Restart the session so tools load.
+
+  Requires a hosted Grafana Cloud stack and the "Assistant Cloud MCP User"
+  role (Editor or higher has it by default). Self-hosted Grafana isn't
+  supported by this endpoint — use the OSS mcp-grafana server instead.