k8s/iam: add cloudnativepg postgres and vault + authentik

- PostgreSQL 3-replica HA with pgvector
- Vault S3 storage backend (MinIO)
- Authentik federated OIDC provider
- Vault auto-unseal via postStart hook

k8s/talos-iam/authentik-migrations-job.yaml

@@ -0,0 +1,24 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: authentik-migrations
+  namespace: iam
+spec:
+  ttlSecondsAfterFinished: 600
+  backoffLimit: 3
+  template:
+    spec:
+      serviceAccountName: default
+      restartPolicy: Never
+      containers:
+      - name: migrate
+        image: ghcr.io/goauthentik/server:2026.5.4
+        imagePullPolicy: IfNotPresent
+        envFrom:
+        - secretRef:
+            name: authentik
+        command:
+        - /bin/sh
+        - -c
+        - |
+          python -m manage migrate --noinput && echo "✓ Migrations complete"