refactor(cnpg): adopt simple pattern - all apps use 'app' user

ARCHITECTURAL CHANGE: Align with CNPG design intent

BEFORE (Complex, broken):
  - Per-app roles (authentik, temporal) with Database CR owner field
  - Database CR doesn't transfer ownership properly
  - Needed manual permission grants (PostSync Job)
  - Apps couldn't create tables without grants from 'app' role

AFTER (Simple, works):
  - All apps use shared 'app' bootstrap user
  - Database CRs: owner: app (matches actual ownership)
  - No permission grants needed (owner has full rights)
  - Isolation via separate database names only

CHANGES:
  - Database CRs: owner changed from app-specific to 'app'
  - ddb-cluster.yaml: removed managed.roles section
  - Deleted grant-schema-permissions PostSync Job
  - Follows Forgejo pattern (already working this way)

MANUAL STEPS REQUIRED:
  1. Update authentik-secrets: AUTHENTIK_POSTGRESQL__USER=app
  2. Update temporal secrets: similar change
  3. Recreate databases with app as owner
  4. Restart applications

Benefits:
  - Simpler architecture
  - No permission grant complexity
  - Aligns with CNPG single-cluster design
  - Matches working Forgejo implementation

k8s/data/schemas/kustomization.yaml

@@ -8,7 +8,6 @@ namespace: ddb
 # GitOps-managed database schemas (ArgoCD wave 6).
 # These depend on ddb-cluster existing (bootstrap wave 0).
 resources:
-  - grant-schema-permissions-job.yaml
   - authentik-database.yaml
   - temporal-database.yaml
   - temporal-visibility-database.yaml