feat(poimen): restrict the memory database to its own namespace

The database was already off the internet: every memory-db service is ClusterIP,
no Ingress backs one, and no public DNS name resolves to them.

That is not isolation. A ClusterIP service answers every pod in the cluster, so
any workload in any namespace could open 5432. Cilium enforces NetworkPolicy, so
stating the allowed sources is what closes it.

Two sources:
- namespace poimen, which holds every client (poimen-memory, poimen-graphql,
  poimen-worker, poimen-workflows, the migration Job)
- namespace cnpg-system, where the CloudNativePG operator connects for switchover
  and failover

Port 5432 only. The operator metrics port stays closed because no PodMonitor for
this cluster exists.

k8s/infra/poimen/kustomization.yaml

@@ -6,6 +6,8 @@ kind: Kustomization
 # deployments (wave 0) are applied.
 resources:
   - memory-db.yaml
+  # ClusterIP alone is not isolation: every pod in the cluster can reach it.
+  - memory-db-netpol.yaml
   - poimen-sandbox-namespace.yaml
   - poimen-sandbox-quota.yaml
   - pi-session-netpol.yaml