refactor(cnpg): adopt unified Forgejo pattern for all apps

UNIFIED PATTERN: All apps follow same credential distribution

FORGEJO PATTERN (now universal):
  1. CNPG creates ddb-cluster-app in ddb namespace (source)
  2. bootstrap.sh copies to app namespaces (cicd, iam)
  3. Apps reference local copy via secretKeyRef
  4. No PostSync Jobs needed

CHANGES:
  - bootstrap.sh: Copy ddb-cluster-app to iam namespace (like cicd)
  - authentik-values.yaml: Reference local ddb-cluster-app via env vars
  - Removed: sync-db-credentials PostSync Job (not needed)
  - kustomization.yaml: Removed PostSync Job reference

BENEFITS:
  ✅ Same pattern as working Forgejo
  ✅ No complex PostSync Jobs
  ✅ bootstrap.sh handles setup for future clusters
  ✅ Simple secretKeyRef, no cross-namespace issues
  ✅ ArgoCD manages applications, not secrets

Database recreated with app owner (fresh migrations needed).

bootstrap.sh

@@ -82,6 +82,12 @@ kubectl get secret ddb-cluster-app -n ddb -o yaml \
   | sed 's/namespace: ddb/namespace: cicd/' \
   | kubectl apply -f -
 
+# Copy DB secret to iam namespace (for authentik)
+log "Copying ddb-cluster-app secret to iam namespace..."
+kubectl get secret ddb-cluster-app -n ddb -o yaml \
+  | sed 's/namespace: ddb/namespace: iam/' \
+  | kubectl apply -f -
+
 # 7. Wait for Forgejo
 log "Waiting for Forgejo to be ready..."
 kubectl wait --for=condition=available --timeout=600s \

k8s/security/iam/kustomization.yaml

@@ -15,7 +15,6 @@ resources:
   - key-rotation-cronjob.yaml
   - authentik-provision-job.yaml
   - rbac-dashboard-rolebinding.yaml
-  - sync-db-credentials-job.yaml
 
 # Provisioning/verification python lives in scripts/*.py (real files, linted +
 # diff-friendly) and is generated into ConfigMaps here rather than embedded in

k8s/security/iam/sync-db-credentials-job.yaml

@@ -1,60 +0,0 @@
-# PostSync Job to copy ddb-cluster-app credentials to iam namespace
-# Allows authentik to reference 'app' user credentials locally
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: sync-db-credentials
-  namespace: iam
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: secret-copier
-rules:
-  - apiGroups: [""]
-    resources: ["secrets"]
-    verbs: ["get", "create", "update", "patch"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: sync-db-credentials
-subjects:
-  - kind: ServiceAccount
-    name: sync-db-credentials
-    namespace: iam
-roleRef:
-  kind: ClusterRole
-  name: secret-copier
-  apiGroup: rbac.authorization.k8s.io
----
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: sync-db-credentials
-  namespace: iam
-  annotations:
-    argocd.argoproj.io/hook: PostSync
-    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
-spec:
-  backoffLimit: 3
-  template:
-    spec:
-      serviceAccountName: sync-db-credentials
-      restartPolicy: Never
-      containers:
-      - name: copy-secret
-        image: alpine/k8s:1.30.3
-        command:
-        - /bin/sh
-        - -c
-        - |
-          set -e
-          echo "Copying ddb-cluster-app secret from ddb to iam namespace..."
-          
-          # Get secret from ddb namespace
-          kubectl get secret ddb-cluster-app -n ddb -o json | \
-            jq 'del(.metadata.namespace, .metadata.uid, .metadata.resourceVersion, .metadata.creationTimestamp, .metadata.ownerReferences) | .metadata.namespace="iam"' | \
-            kubectl apply -f -
-          
-          echo "Secret copied successfully"