refactor(cnpg): adopt simple pattern - all apps use 'app' user

ARCHITECTURAL CHANGE: Align with CNPG design intent

BEFORE (Complex, broken):
  - Per-app roles (authentik, temporal) with Database CR owner field
  - Database CR doesn't transfer ownership properly
  - Needed manual permission grants (PostSync Job)
  - Apps couldn't create tables without grants from 'app' role

AFTER (Simple, works):
  - All apps use shared 'app' bootstrap user
  - Database CRs: owner: app (matches actual ownership)
  - No permission grants needed (owner has full rights)
  - Isolation via separate database names only

CHANGES:
  - Database CRs: owner changed from app-specific to 'app'
  - ddb-cluster.yaml: removed managed.roles section
  - Deleted grant-schema-permissions PostSync Job
  - Follows Forgejo pattern (already working this way)

MANUAL STEPS REQUIRED:
  1. Update authentik-secrets: AUTHENTIK_POSTGRESQL__USER=app
  2. Update temporal secrets: similar change
  3. Recreate databases with app as owner
  4. Restart applications

Benefits:
  - Simpler architecture
  - No permission grant complexity
  - Aligns with CNPG single-cluster design
  - Matches working Forgejo implementation

k8s/data/cluster/ddb-cluster.yaml

@@ -27,22 +27,10 @@ spec:
         - CREATE EXTENSION IF NOT EXISTS pgcrypto;
         - CREATE EXTENSION IF NOT EXISTS pg_trgm;
 
-  # Per-app login roles, passwords sourced from secrets (CNPG reconciles the
-  # role password to match the secret). Their databases are separate Database
-  # CRs (see authentik-database.yaml / temporal-database.yaml) owned by these
-  # roles. Replaces the old helmfile post-sync user-creation hook.
-  managed:
-    roles:
-      - name: authentik
-        ensure: present
-        login: true
-        passwordSecret:
-          name: authentik-db-role
-      - name: temporal
-        ensure: present
-        login: true
-        passwordSecret:
-          name: temporal-db-role
+  # Simple ownership model: all apps use 'app' bootstrap user.
+  # Isolation via separate database names, not separate roles.
+  # Aligns with CNPG design (single cluster, multiple databases).
+  # managed.roles removed - no per-app roles needed.
 
   # Disable superuser (security)
   enableSuperuserAccess: false