k8s/iam: add cloudnativepg postgres and vault + authentik

- PostgreSQL 3-replica HA with pgvector
- Vault S3 storage backend (MinIO)
- Authentik federated OIDC provider
- Vault auto-unseal via postStart hook

k8s/ddb/init-users.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+# Safe database initialization script
+# Applies init-users.sql with environment variable substitution
+# Exit on any error
+set -euo pipefail
+
+# Get superuser password from CNPG secret
+PG_PASSWORD=$(kubectl get secret -n ddb ddb-cluster-app -o jsonpath='{.data.password}' | base64 -d)
+export PGPASSWORD="$PG_PASSWORD"
+
+# Apply SQL with safe variable substitution (psql -v prevents injection)
+psql \
+  -h ddb-cluster-rw.ddb.svc.cluster.local \
+  -U postgres \
+  -d postgres \
+  -v authentik_password="$AUTHENTIK_PG_PASSWORD" \
+  -v story_crater_password="$STORY_CRATER_PG_PASSWORD" \
+  -f k8s/ddb/init-users.sql
+
+unset PGPASSWORD
+echo "✓ Database initialization complete"