refactor(cnpg): adopt unified Forgejo pattern for all apps

UNIFIED PATTERN: All apps follow same credential distribution

FORGEJO PATTERN (now universal):
  1. CNPG creates ddb-cluster-app in ddb namespace (source)
  2. bootstrap.sh copies to app namespaces (cicd, iam)
  3. Apps reference local copy via secretKeyRef
  4. No PostSync Jobs needed

CHANGES:
  - bootstrap.sh: Copy ddb-cluster-app to iam namespace (like cicd)
  - authentik-values.yaml: Reference local ddb-cluster-app via env vars
  - Removed: sync-db-credentials PostSync Job (not needed)
  - kustomization.yaml: Removed PostSync Job reference

BENEFITS:
  ✅ Same pattern as working Forgejo
  ✅ No complex PostSync Jobs
  ✅ bootstrap.sh handles setup for future clusters
  ✅ Simple secretKeyRef, no cross-namespace issues
  ✅ ArgoCD manages applications, not secrets

Database recreated with app owner (fresh migrations needed).

bootstrap.sh

@@ -82,6 +82,12 @@ kubectl get secret ddb-cluster-app -n ddb -o yaml \
   | sed 's/namespace: ddb/namespace: cicd/' \
   | kubectl apply -f -
 
+# Copy DB secret to iam namespace (for authentik)
+log "Copying ddb-cluster-app secret to iam namespace..."
+kubectl get secret ddb-cluster-app -n ddb -o yaml \
+  | sed 's/namespace: ddb/namespace: iam/' \
+  | kubectl apply -f -
+
 # 7. Wait for Forgejo
 log "Waiting for Forgejo to be ready..."
 kubectl wait --for=condition=available --timeout=600s \