refactor(k8s): consolidate to infra/+apps/ single-source tree, dedicated per-app CNPG (authentik-db/temporal-db), wire monitoring-config, forgejo→cicd ns, drop orphan/stale (data-schemas, ollama, story-crater, sqs/argocd, key-rotation)

k8s/bootstrap/README.md

@@ -115,7 +115,7 @@ git push forgejo main
 
 - **Phase stuck?** Check `kubectl get events -n <namespace> --sort-by='.lastTimestamp'`
 - **ArgoCD duplicating?** Verify manifests match exactly (Helm values ↔ ArgoCD Application)
-- **Forgejo won't start?** Check CNPG cluster Ready: `kubectl get cluster forgejo-db -n forgejo`
+- **Forgejo won't start?** Check CNPG cluster Ready: `kubectl get cluster forgejo-db -n cicd`
 - **Can't push to Forgejo?** Verify ingress-nginx healthy, DNS resolves `forgejo.riotpiao.com`
 
 ## Migration from Old Bootstrap

k8s/bootstrap/phase3-forgejo/forgejo-db.yaml

@@ -5,7 +5,7 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: forgejo
+  name: cicd
   annotations:
     argocd.argoproj.io/sync-options: Prune=false
 ---
@@ -13,7 +13,7 @@ apiVersion: postgresql.cnpg.io/v1
 kind: Cluster
 metadata:
   name: forgejo-db
-  namespace: forgejo
+  namespace: cicd
   annotations:
     argocd.argoproj.io/sync-options: Prune=false  # Let ArgoCD adopt, don't delete
   labels:
@@ -71,15 +71,21 @@ spec:
     enablePodMonitor: true
 
   affinity:
-    podAntiAffinityType: required
+    # preferred (not required) so it can't deadlock if fewer than 3 nodes are
+    # schedulable; tolerations let CNPG pods land on control-plane nodes.
+    podAntiAffinityType: preferred
     topologyKey: kubernetes.io/hostname
+    tolerations:
+      - key: node-role.kubernetes.io/control-plane
+        operator: Exists
+        effect: NoSchedule
 ---
 # Forgejo Redis (cache, session, queue)
 apiVersion: v1
 kind: Service
 metadata:
   name: forgejo-redis
-  namespace: forgejo
+  namespace: cicd
   annotations:
     argocd.argoproj.io/sync-options: Prune=false
 spec:
@@ -95,7 +101,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: forgejo-redis
-  namespace: forgejo
+  namespace: cicd
   annotations:
     argocd.argoproj.io/sync-options: Prune=false
 spec:
@@ -108,6 +114,10 @@ spec:
       labels:
         app: forgejo-redis
     spec:
+      tolerations:
+        - key: node-role.kubernetes.io/control-plane
+          operator: Exists
+          effect: NoSchedule
       containers:
         - name: redis
           image: redis:7-alpine

k8s/bootstrap/phase3-forgejo/forgejo-values.yaml

@@ -16,7 +16,7 @@ gitea:
       
     database:
       DB_TYPE: postgres
-      HOST: forgejo-db-rw.forgejo.svc.cluster.local:5432
+      HOST: forgejo-db-rw.cicd.svc.cluster.local:5432
       NAME: forgejo
       # User/password from CNPG-generated secret
       USER:
@@ -32,15 +32,15 @@ gitea:
       
     cache:
       ADAPTER: redis
-      HOST: redis://forgejo-redis.forgejo.svc.cluster.local:6379/0
+      HOST: redis://forgejo-redis.cicd.svc.cluster.local:6379/0
       
     session:
       PROVIDER: redis
-      PROVIDER_CONFIG: redis://forgejo-redis.forgejo.svc.cluster.local:6379/1
+      PROVIDER_CONFIG: redis://forgejo-redis.cicd.svc.cluster.local:6379/1
       
     queue:
       TYPE: redis
-      CONN_STR: redis://forgejo-redis.forgejo.svc.cluster.local:6379/2
+      CONN_STR: redis://forgejo-redis.cicd.svc.cluster.local:6379/2
 
 # Persistence (shared storage for repos)
 persistence: