feat(poimen): restrict the memory database to its own namespace

The database was already off the internet: every memory-db service is ClusterIP,
no Ingress backs one, and no public DNS name resolves to them.

That is not isolation. A ClusterIP service answers every pod in the cluster, so
any workload in any namespace could open 5432. Cilium enforces NetworkPolicy, so
stating the allowed sources is what closes it.

Two sources:
- namespace poimen, which holds every client (poimen-memory, poimen-graphql,
  poimen-worker, poimen-workflows, the migration Job)
- namespace cnpg-system, where the CloudNativePG operator connects for switchover
  and failover

Port 5432 only. The operator metrics port stays closed because no PodMonitor for
this cluster exists.

k8s/infra/poimen/graphql-netpol.yaml

@@ -1,28 +0,0 @@
----
-# Keep the GraphQL server reachable only from the one service that proxies it.
-#
-# poimen-graphql is already off the internet: its Service is ClusterIP on 8090 and
-# no Ingress names it. What it lacked is in-cluster isolation — a ClusterIP answers
-# every pod in the cluster.
-#
-# The only caller is poimen-memory, whose /graphql route forwards the request body
-# to MEM_GQL_PORT (8090). No other workload references this service.
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: poimen-graphql-ingress
-  namespace: poimen
-spec:
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/name: poimen-graphql
-  policyTypes:
-    - Ingress
-  ingress:
-    - from:
-        - podSelector:
-            matchLabels:
-              app.kubernetes.io/name: poimen-memory
-      ports:
-        - protocol: TCP
-          port: 8090

k8s/infra/poimen/kustomization.yaml

@@ -8,8 +8,6 @@ resources:
   - memory-db.yaml
   # ClusterIP alone is not isolation: every pod in the cluster can reach it.
   - memory-db-netpol.yaml
-  # Only poimen-memory's /graphql proxy calls 8090.
-  - graphql-netpol.yaml
   - poimen-sandbox-namespace.yaml
   - poimen-sandbox-quota.yaml
   - pi-session-netpol.yaml