refactor(k8s): consolidate to infra/+apps/ single-source tree, dedicated per-app CNPG (authentik-db/temporal-db), wire monitoring-config, forgejo→cicd ns, drop orphan/stale (data-schemas, ollama, story-crater, sqs/argocd, key-rotation)

k8s/infra/longhorn/kustomization.yaml

@@ -0,0 +1,16 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: longhorn-system
+resources:
+  - longhorn-storageclass.yaml
+  - longhorn-cnpg-storageclass.yaml  # CNPG-specific with postgres UID/GID
+  - longhorn-servicemonitor.yaml
+  - longhorn-taint-toleration.yaml
+  - longhorn-nodes.yaml
+  - expand-replicas-job.yaml
+  - patch-csi-tolerations-job.yaml
+# Longhorn deployed via bootstrap script or Helm.
+# These manifests configure it: unified StorageClass (default, 3 replicas),
+# Prometheus ServiceMonitor, taint toleration for control-plane nodes, explicit
+# Node CRDs for cp-2/cp-3, CSI plugin tolerations, and a PostSync hook Job
+# that ensures all existing volumes have 3 replicas.