fix(authentik): use 'app' database credentials from CNPG (GitOps)

GITOPS FIX: Permanent solution for database credentials

CHANGES:
  1. authentik-values.yaml:
     - postgresql.user: authentik → app
     - env vars reference ddb-cluster-app secret (via secretKeyRef)
     - Both server + worker containers updated

  2. sync-db-credentials-job.yaml (PostSync):
     - Copies ddb-cluster-app from ddb → iam namespace
     - Allows secretKeyRef to work (no cross-namespace support)
     - Runs after every iam-jobs sync

  3. kustomization.yaml:
     - Added sync-db-credentials-job to resources

REPLACES:
  - Manual kubectl patch of authentik-secrets
  - SOPS-encrypted per-app credentials
  - Complex permission grants

BENEFITS:
  ✅ ArgoCD won't revert changes (in git)
  ✅ Follows CNPG simple pattern (app user)
  ✅ Single source of truth (ddb-cluster-app)
  ✅ Auto-syncs on every deploy

Deployed by: iam-jobs Application (wave 3)

k8s/security/iam/authentik-values.yaml

@@ -23,13 +23,14 @@ authentik:
     enabled: false   # do not phone home to Sentry
 
   # PostgreSQL connection — points at CloudNativePG cluster in ddb namespace.
-  # password is injected via helmfile --set at deploy time.
+  # Uses 'app' bootstrap user (CNPG simple pattern, same as Forgejo).
+  # Credentials injected from ddb-cluster-app secret via env vars below.
   postgresql:
     host: ddb-cluster-rw.ddb.svc.cluster.local
     port: 5432
     name: authentik
-    user: authentik
-    password: ""  # injected via helmfile --set authentik.postgresql.password
+    user: app  # All apps use shared 'app' user (CNPG design pattern)
+    password: ""  # overridden by AUTHENTIK_POSTGRESQL__PASSWORD env var
 
   # Redis connection — bundled subchart, standalone mode (no sentinel/cluster).
   redis:
@@ -123,7 +124,23 @@ server:
   volumes: *caVolumes
   volumeMounts: *caVolumeMounts
   initContainers: *caInitContainers
-  env: *caEnv
+  env:
+    # Merge CA trust env vars
+    - name: REQUESTS_CA_BUNDLE
+      value: /merged/ca-bundle.crt
+    - name: SSL_CERT_FILE
+      value: /merged/ca-bundle.crt
+    # Override database credentials to use 'app' from ddb-cluster-app
+    - name: AUTHENTIK_POSTGRESQL__USER
+      valueFrom:
+        secretKeyRef:
+          name: ddb-cluster-app
+          key: username
+    - name: AUTHENTIK_POSTGRESQL__PASSWORD
+      valueFrom:
+        secretKeyRef:
+          name: ddb-cluster-app
+          key: password
   podAnnotations:
     configmap.reloader.stakater.com/reload: "homelab-ca"
     homelab.io/restart-at: "2026-06-21T13-40"
@@ -178,7 +195,23 @@ worker:
   volumes: *caVolumes
   volumeMounts: *caVolumeMounts
   initContainers: *caInitContainers
-  env: *caEnv
+  env:
+    # Merge CA trust env vars
+    - name: REQUESTS_CA_BUNDLE
+      value: /merged/ca-bundle.crt
+    - name: SSL_CERT_FILE
+      value: /merged/ca-bundle.crt
+    # Override database credentials to use 'app' from ddb-cluster-app
+    - name: AUTHENTIK_POSTGRESQL__USER
+      valueFrom:
+        secretKeyRef:
+          name: ddb-cluster-app
+          key: username
+    - name: AUTHENTIK_POSTGRESQL__PASSWORD
+      valueFrom:
+        secretKeyRef:
+          name: ddb-cluster-app
+          key: password
   podAnnotations:
     configmap.reloader.stakater.com/reload: "homelab-ca"
     homelab.io/restart-at: "2026-06-21T13-40"