refactor(cnpg): unify all apps on 'app' database user/credentials pattern

k8s/data/cluster/ddb-cluster.yaml

@@ -27,22 +27,10 @@ spec:
         - CREATE EXTENSION IF NOT EXISTS pgcrypto;
         - CREATE EXTENSION IF NOT EXISTS pg_trgm;
 
-  # Per-app login roles, passwords sourced from secrets (CNPG reconciles the
-  # role password to match the secret). Their databases are separate Database
-  # CRs (see authentik-database.yaml / temporal-database.yaml) owned by these
-  # roles. Replaces the old helmfile post-sync user-creation hook.
-  managed:
-    roles:
-      - name: authentik
-        ensure: present
-        login: true
-        passwordSecret:
-          name: authentik-db-role
-      - name: temporal
-        ensure: present
-        login: true
-        passwordSecret:
-          name: temporal-db-role
+  # Simple ownership model: all apps use 'app' bootstrap user.
+  # Isolation via separate database names, not separate roles.
+  # Aligns with CNPG design (single cluster, multiple databases).
+  # managed.roles removed - no per-app roles needed.
 
   # Disable superuser (security)
   enableSuperuserAccess: false