refactor(temporal): adopt unified CNPG pattern - use 'app' user

CHANGES:
  - temporal-values.yaml: user 'app', existingSecret 'ddb-cluster-app'
  - bootstrap.sh: Copy ddb-cluster-app to temporal namespace
  - Removed db-secret-sync directory (obsolete PostSync Job)
  - 60-applications.yaml: Removed db-secret-sync source from temporal Application

PATTERN (same as Forgejo/Authentik):
  1. Database CR: owner app
  2. bootstrap.sh: Copy ddb-cluster-app to temporal namespace
  3. App values: Reference ddb-cluster-app secret
  4. No PostSync Jobs needed

FIXES:
  - Temporal schema CrashLoopBackOff (wrong credentials)
  - Dropped/recreated databases with app owner (clean state)

Following CLAUDE.md CNPG pattern documentation.

k8s/applications/temporal/temporal-values.yaml

@@ -95,14 +95,15 @@ server:
           host: "ddb-cluster-rw.ddb.svc.cluster.local"
           port: 5432
           database: "temporal"
-          user: "temporal"
+          user: "app"
           # existingSecret + secretKey: point directly at the CNPG-generated
           # Secret (kubernetes.io/basic-auth, keys: username/password/...)
           # rather than duplicating the password in git as plaintext. When
           # existingSecret is set the chart's own server-secret.yaml Secret
           # template is skipped entirely (see templates/server-secret.yaml:
           # `not $driverConfig.existingSecret` guards its creation).
-          existingSecret: "temporal-db-role"
+          # Use unified ddb-cluster-app secret (copied to temporal namespace)
+          existingSecret: "ddb-cluster-app"
           secretKey: "password"
           maxConns: 20
           maxIdleConns: 10
@@ -120,8 +121,9 @@ server:
           host: "ddb-cluster-rw.ddb.svc.cluster.local"
           port: 5432
           database: "temporal_visibility"
-          user: "temporal"
-          existingSecret: "temporal-db-role"
+          user: "app"
+          # Use unified ddb-cluster-app secret (copied to temporal namespace)
+          existingSecret: "ddb-cluster-app"
           secretKey: "password"
           maxConns: 20
           maxIdleConns: 10