Finally I had the need for feeding multiple Prometheus sources into my Grafana instance and burned 2 hours to discover that my #Tailscale ACLs were actually fine the whole time and not in fact gaslighting me about the passing tests.

Apparently when I first set up Prometheus I had stupidly copied in my Grafana instance's proxy authentication Caddy config so only my user could access it, while the Grafana instance was running as its own tagged device via caddy-tailscale.