feat: allow targeted applies and keep the Grafana token rotated

[nboyers]

Unblocks the Expired API key plan failure on #117, and stops it recurring.

The bug

The Grafana service-account token lives in aws/us-east-2/monitoring:

locals { rotation_days = 30 }
resource "time_rotating" "admin" { rotation_days = local.rotation_days }
resource "aws_grafana_workspace_service_account_token" "admin" {
  seconds_to_live = local.rotation_days * 24 * 60 * 60
}

time_rotating only rotates when that unit is applied. Before per-unit filtering landed (2026-07-30), every push to main applied the whole estate, so it stayed fresh. Now nothing applies it unless its own files change — last touched 2026-07-29. The token lapsed, and terraform plan on aws/us-east-2/grafana 401s reading its existing datasources and dashboards. Plan can't fix it: it reads the dependency output from state and never applies anything.

Changes

• workflow_dispatch gains a filter input so one unit can be applied from CI. There was no way to do this before — dispatch set changed_dirs=[] and applied all 33 units.
• A weekly schedule (0 6 * * 1) re-applies only aws/us-east-2/monitoring, restoring what full-estate applies used to do implicitly.
• Push behaviour unchanged.

Notes for review

• This adds unattended production applies on a timer — new for this repo. Scoped to one unit whose only job is credential rotation (IAM role/policy, a security group, the Grafana + Prometheus workspaces, the token). No EKS addons, no cluster resources. Say the word and I'll drop the cron and keep only the dispatch input.
• The dispatch input is read via env: rather than template interpolation and validated against a path charset, because FILTER_ARGS is later eval'd.
• Scheduled workflows only run from the default branch, so the cron starts after merge.
• Branched off main, not fix: scope terraform CI to what actually changed #117, so it can land independently. fix: scope terraform CI to what actually changed #117 will need a rebase.

Verified

Logic simulated locally: schedule → ["aws/us-east-2/monitoring"]; dispatch with one or several units → correct --filter= args; ; rm -rf /, $(id), and backtick inputs all rejected.

🤖 Generated with Claude Code