5. What this key can and cannot see

Through this datasource, Grafana can query time-series metrics only — the
same read endpoints a stock Prometheus datasource uses (instant and range
queries, series/label browsing, metric metadata). It cannot see sessions,
subscriber addresses, or configuration: the key's path scope confines every
request to the proxy path, and anything outside the metrics read surface
(including Prometheus's own config/admin endpoints) is rejected as not found.