refactor(cnpg): adopt unified Forgejo pattern for all apps

UNIFIED PATTERN: All apps follow same credential distribution

FORGEJO PATTERN (now universal):
  1. CNPG creates ddb-cluster-app in ddb namespace (source)
  2. bootstrap.sh copies to app namespaces (cicd, iam)
  3. Apps reference local copy via secretKeyRef
  4. No PostSync Jobs needed

CHANGES:
  - bootstrap.sh: Copy ddb-cluster-app to iam namespace (like cicd)
  - authentik-values.yaml: Reference local ddb-cluster-app via env vars
  - Removed: sync-db-credentials PostSync Job (not needed)
  - kustomization.yaml: Removed PostSync Job reference

BENEFITS:
  ✅ Same pattern as working Forgejo
  ✅ No complex PostSync Jobs
  ✅ bootstrap.sh handles setup for future clusters
  ✅ Simple secretKeyRef, no cross-namespace issues
  ✅ ArgoCD manages applications, not secrets

Database recreated with app owner (fresh migrations needed).

k8s/security/iam/kustomization.yaml

@@ -15,7 +15,6 @@ resources:
   - key-rotation-cronjob.yaml
   - authentik-provision-job.yaml
   - rbac-dashboard-rolebinding.yaml
-  - sync-db-credentials-job.yaml
 
 # Provisioning/verification python lives in scripts/*.py (real files, linted +
 # diff-friendly) and is generated into ConfigMaps here rather than embedded in