fix(gotify): CNPG Postgres backend, SOPS-encrypt secrets

- Replace SQLite + PVC with CNPG Postgres cluster (2 replicas, longhorn-cnpg)
- Connection string built at runtime via shell wrapper (env var interpolation)
- Remove gotify-data PVC (DB handles persistence)
- Encrypt secrets.yaml with SOPS
- Add db.yaml: gotify-db cluster in notifications namespace

k8s/apps/gotify/deployment.yaml

@@ -24,6 +24,12 @@ spec:
         # --- Gotify server ---
         - name: gotify
           image: ghcr.io/gotify/server:2.6.1
+          command: ["/bin/sh", "-c"]
+          args:
+            - |
+              export GOTIFY_DATABASE_DIALECT=postgres
+              export GOTIFY_DATABASE_CONNECTION="host=gotify-db-rw.notifications port=5432 user=${DB_USER} password=${DB_PASS} dbname=gotify sslmode=disable"
+              exec /app/gotify-app
           ports:
             - containerPort: 80
               protocol: TCP
@@ -38,6 +44,16 @@ spec:
                 secretKeyRef:
                   name: gotify-admin
                   key: password
+            - name: DB_USER
+              valueFrom:
+                secretKeyRef:
+                  name: gotify-db-app
+                  key: username
+            - name: DB_PASS
+              valueFrom:
+                secretKeyRef:
+                  name: gotify-db-app
+                  key: password
             - name: GOTIFY_SERVER_PORT
               value: "80"
             - name: GOTIFY_SERVER_KEEPALIVEPERIODSECONDS
@@ -51,9 +67,6 @@ spec:
             limits:
               cpu: 200m
               memory: 128Mi
-          volumeMounts:
-            - mountPath: /app/data
-              name: data
           livenessProbe:
             httpGet:
               path: /health
@@ -188,7 +201,4 @@ spec:
             limits:
               cpu: 100m
               memory: 64Mi
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: gotify-data
+      # No volumes — Postgres handles persistence