fix(gotify): CNPG Postgres backend, SOPS-encrypt secrets

- Replace SQLite + PVC with CNPG Postgres cluster (2 replicas, longhorn-cnpg)
- Connection string built at runtime via shell wrapper (env var interpolation)
- Remove gotify-data PVC (DB handles persistence)
- Encrypt secrets.yaml with SOPS
- Add db.yaml: gotify-db cluster in notifications namespace

k8s/apps/gotify/kustomization.yaml

@@ -2,7 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - namespace.yaml
-  - pvc.yaml
+  - db.yaml
   - secrets.yaml
   - deployment.yaml
   - service.yaml