fix(authentik): use 'app' database credentials from CNPG (GitOps)

GITOPS FIX: Permanent solution for database credentials

CHANGES:
  1. authentik-values.yaml:
     - postgresql.user: authentik → app
     - env vars reference ddb-cluster-app secret (via secretKeyRef)
     - Both server + worker containers updated

  2. sync-db-credentials-job.yaml (PostSync):
     - Copies ddb-cluster-app from ddb → iam namespace
     - Allows secretKeyRef to work (no cross-namespace support)
     - Runs after every iam-jobs sync

  3. kustomization.yaml:
     - Added sync-db-credentials-job to resources

REPLACES:
  - Manual kubectl patch of authentik-secrets
  - SOPS-encrypted per-app credentials
  - Complex permission grants

BENEFITS:
  ✅ ArgoCD won't revert changes (in git)
  ✅ Follows CNPG simple pattern (app user)
  ✅ Single source of truth (ddb-cluster-app)
  ✅ Auto-syncs on every deploy

Deployed by: iam-jobs Application (wave 3)

k8s/security/iam/kustomization.yaml

@@ -15,6 +15,7 @@ resources:
   - key-rotation-cronjob.yaml
   - authentik-provision-job.yaml
   - rbac-dashboard-rolebinding.yaml
+  - sync-db-credentials-job.yaml
 
 # Provisioning/verification python lives in scripts/*.py (real files, linted +
 # diff-friendly) and is generated into ConfigMaps here rather than embedded in