refactor(temporal): adopt unified CNPG pattern - use 'app' user

CHANGES:
  - temporal-values.yaml: user 'app', existingSecret 'ddb-cluster-app'
  - bootstrap.sh: Copy ddb-cluster-app to temporal namespace
  - Removed db-secret-sync directory (obsolete PostSync Job)
  - 60-applications.yaml: Removed db-secret-sync source from temporal Application

PATTERN (same as Forgejo/Authentik):
  1. Database CR: owner app
  2. bootstrap.sh: Copy ddb-cluster-app to temporal namespace
  3. App values: Reference ddb-cluster-app secret
  4. No PostSync Jobs needed

FIXES:
  - Temporal schema CrashLoopBackOff (wrong credentials)
  - Dropped/recreated databases with app owner (clean state)

Following CLAUDE.md CNPG pattern documentation.

k8s/argocd/apps/60-applications.yaml

@@ -2,9 +2,8 @@
 # helpers (cloudflared tunnel, duckdns updater) that are already running.
 # Experimental dirs (llm, forge, dev-tools, shadowsocks) are intentionally
 # NOT included yet — add them here once they're production-ready.
-# Consolidated: temporal-db-secret-sync + temporal → temporal
-# Syncs the CNPG-generated temporal-db-role Secret from ddb -> temporal ns
-# via PostSync hook (db-secret-sync/copy-job.yaml).
+# temporal using unified CNPG pattern (app user, ddb-cluster-app secret)
+# Secret copied by bootstrap.sh (like cicd/iam namespaces)
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
@@ -24,9 +23,6 @@ spec:
     - repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
       targetRevision: main
       ref: values
-    - repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
-      targetRevision: main
-      path: k8s/applications/temporal/db-secret-sync  # PostSync hook: copy-job.yaml
   destination:
     server: https://kubernetes.default.svc
     namespace: temporal