feat(data): add CNPG managed roles + Database CRs for authentik/temporal — replaces missing helmfile post-sync user creation

authentik/temporal DB users+databases were never provisioned (old helmfile hook
gone; db-init-job only made schemas in shared app DB). Adds managed.roles
(authentik/temporal login roles, passwords from basic-auth secrets) + Database CRs
(dedicated DBs owned by each role). Role secrets applied out-of-band (SOPS), not in
kustomize resources so data-schemas app doesn't choke on ciphertext.

k8s/data/ddb-cluster.yaml

@@ -28,6 +28,23 @@ spec:
         - CREATE EXTENSION IF NOT EXISTS pgcrypto;
         - CREATE EXTENSION IF NOT EXISTS pg_trgm;
 
+  # Per-app login roles, passwords sourced from secrets (CNPG reconciles the
+  # role password to match the secret). Their databases are separate Database
+  # CRs (see authentik-database.yaml / temporal-database.yaml) owned by these
+  # roles. Replaces the old helmfile post-sync user-creation hook.
+  managed:
+    roles:
+      - name: authentik
+        ensure: present
+        login: true
+        passwordSecret:
+          name: authentik-db-role
+      - name: temporal
+        ensure: present
+        login: true
+        passwordSecret:
+          name: temporal-db-role
+
   # Disable superuser (security)
   enableSuperuserAccess: false