fix(k8s,docs): scale ddb-cluster to single instance, pin minio to storage namespace, document 3-CP topology in USAGE

USAGE.md

@@ -1,6 +1,18 @@
 ## Cluster Architecture at a Glance
 
-**Homelab** is a 2-node bare-metal Kubernetes cluster deployed with Talos Linux, designed for self-hosted services, observability, and GitOps-ready CI/CD.
+**Homelab** is a 3-node bare-metal Kubernetes cluster deployed with Talos Linux, designed for self-hosted services, observability, and GitOps-ready CI/CD.
+
+### Node Topology (3 control-plane HA, since 2026-07-20)
+
+| Node | IP | Zone | Role | Scheduling | Storage |
+|------|----|----|------|-----------|---------|
+| `talos-cp-1` | 192.168.1.213 | az-a | control-plane | **schedulable** (runs all workloads) | sole Longhorn node (sdb/sdc/sdd) |
+| `talos-cp-2` | 192.168.1.163 | az-b | control-plane | dedicated (`NoSchedule`) | none |
+| `talos-cp-3` | 192.168.1.166 | az-c | control-plane | dedicated (`NoSchedule`) | none |
+
+- **etcd** has 3 voting members peering over the LAN (`cluster.etcd.advertisedSubnets: 192.168.1.0/24` — without it Talos may advertise on the WireGuard IP and new members hang as learners). Tolerates 1 node loss.
+- Only `talos-cp-1` runs workloads and holds storage, so stateful services are **single-instance** (e.g. CNPG `ddb-cluster` = 1 instance). The kube-apiserver endpoint is single-homed to `.213` (no VIP yet).
+- Scheduling is declarative: `allowSchedulingOnControlPlanes: true` + per-node `machine.nodeTaints` re-adds the control-plane taint on the dedicated nodes only.
 
 ### Deployment Stack (18 Helm releases)
 
@@ -12,7 +24,7 @@
 | **Certificates** | cert-manager + homelab-ca | cert-manager | Self-signed CA, auto-renewal |
 | **Storage (Block)** | Longhorn v1.7.0 | longhorn-system | Persistent volumes, default StorageClass |
 | **Storage (Object)** | MinIO (3-node, site-repl) | storage | S3-compatible, multi-AZ replication |
-| **Database** | CloudNativePG (3 replicas) | ddb | PostgreSQL 16 + pgvector |
+| **Database** | CloudNativePG (1 instance) | ddb | PostgreSQL 16 + pgvector (single-node; see topology) |
 | **IAM / OIDC** | Authentik | iam | Federated OIDC provider for all services |
 | **Secrets** | HashiCorp Vault | iam | KV secrets backend, JWT auth |
 | **Logs** | Loki (SingleBinary) | logging | 10-day retention, MinIO backend |

k8s/data/ddb-cluster.yaml

@@ -7,8 +7,10 @@ metadata:
     app: postgresql
     layer: data
 spec:
-  # 3-node cluster for HA
-  instances: 3
+  # Single instance — cp-1 is the only schedulable node in the 3-CP topology
+  # (.163/.166 are dedicated control planes with no workload scheduling/storage).
+  # Postgres standby HA is traded away; control-plane/etcd HA is unaffected.
+  instances: 1
 
   # PostgreSQL 16.2
   imageName: ghcr.io/cloudnative-pg/postgresql:16.2

k8s/infrastructure/minio/buckets.yaml

@@ -4,7 +4,7 @@ apiVersion: minio.min.io/v1alpha1
 kind: Bucket
 metadata:
   name: riotpiao-models
-  namespace: minio
+  namespace: storage
 spec:
   name: riotpiao-models
   versioning:
@@ -20,7 +20,7 @@ apiVersion: minio.min.io/v1alpha1
 kind: Policy
 metadata:
   name: policy-ollama
-  namespace: minio
+  namespace: storage
 spec:
   name: policy-ollama
   statements:
@@ -42,7 +42,7 @@ apiVersion: minio.min.io/v1alpha1
 kind: User
 metadata:
   name: user-ollama
-  namespace: minio
+  namespace: storage
 spec:
   accessKey: ollama-access-key
   secretKey: ollama-secret-key-changeme  # Override via Secret

k8s/infrastructure/minio/kustomization.yaml

@@ -1,6 +1,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: minio
+namespace: storage
 resources:
   - minio-tenant.yaml
   - minio-service.yaml