chore(telemetry): pin the image renderer and wire its auth token

The renderer was the only service in the stack on a floating :latest tag, so
the stack was not reproducible: a renderer release could change under a
checkout that had not been touched. Pins it to v5.12.0, matching how every
other service here is pinned.

Also wires the shared render token. Grafana 13 enables the renderAuthJWT
feature toggle by default, and the renderer rejects requests unless both sides
present the same non-default token, so pinning alone would leave rendering
broken once the Grafana bump merges forward. Both values come from the same
GF_RENDERING_RENDERER_TOKEN variable and cannot drift apart; the local default
keeps `docker compose up` working with no setup.

Verified `docker compose config` resolves and both AUTH_TOKEN and
GF_RENDERING_RENDERER_TOKEN expand to the same value.

docker/telemetry/docker-compose.yml

@@ -110,6 +110,10 @@ services:
       # the callback URL is how the renderer fetches the panel from grafana.
       - GF_RENDERING_SERVER_URL=http://renderer:8081/render
       - GF_RENDERING_CALLBACK_URL=http://grafana:3000/
+      # Grafana 13 turns the renderAuthJWT feature toggle on by default, which
+      # makes the renderer reject requests unless both sides share a token that
+      # is not the "-" default. Must match AUTH_TOKEN on the renderer service.
+      - GF_RENDERING_RENDERER_TOKEN=${GF_RENDERING_RENDERER_TOKEN:-xrpld-local-render}
     # SMTP for the critical-tier email receiver and the Slack webhook / email
     # address for the contact points all come from the env_file above, which
     # injects them straight into the container environment for Grafana to
@@ -133,7 +137,14 @@ services:
   # Grafana image renderer: a sidecar that renders panels/dashboards to PNG
   # for image export and alerting. Grafana calls it at http://renderer:8081.
   renderer:
-    image: grafana/grafana-image-renderer:latest
+    # Pinned like every other image in this stack so a stack that worked
+    # yesterday still works today. Upstream maintains only the newest release,
+    # which is expected to serve all supported Grafana versions.
+    image: grafana/grafana-image-renderer:v5.12.0
+    environment:
+      # Shared secret for the JWT-authenticated render requests Grafana 13
+      # sends. Must match GF_RENDERING_RENDERER_TOKEN on the grafana service.
+      - AUTH_TOKEN=${GF_RENDERING_RENDERER_TOKEN:-xrpld-local-render}
     ports:
       - "8081:8081" # Renderer HTTP endpoint (called by grafana)
     networks: