One-install Grafana front door over five bearer-auth domain packs and fourteen operating workflows. It admits all 275 buildable service-account operations in the pinned v13.1.0 contract: dashboards and folders, alerting, data sources and migration, organizations and teams, access control, service accounts, SSO administration, annotations, reporting, and query history. A separately installable grafana-server-admin pack covers all 33 Basic-only self-managed server routes without making the Cloud-compatible front door depend on Basic credentials. Five of those routes inherit Swagger metadata that advertises either credential, but their pinned operation prose explicitly requires Basic, so the safer prose restriction wins. Together the packs admit 308 of 314 official routes. Six explicit exclusions are one malformed report-image path plus five browser redirect/callback routes that cannot be represented as service-account calls; supported report, SAML administration, and signed-in-user operations remain covered. Every read is uncached; every mutation is grant-off and approval-gated. Ten non-JSON reads return file_ref values, four Prometheus conversion writes accept literal YAML, and nested-int64 JSON mutations accept literal body_raw JSON rather than rounding identifiers. The contract has no honest task, note, or project projection, so this suite deliberately declares no work-entity Source.