feat(data): Add CNPG cluster + database schema initialization

Create production PostgreSQL cluster via CNPG (3-node HA, Longhorn storage).

Schema initialization Job creates schemas for:
- Authentik (identity provider)
- Temporal (workflow engine)
- Vault (secrets management)
- App (generic application databases)

Database layer now captures complete IaC for stateful infrastructure.
Services find ready schemas when deployed.

k8s/data/ddb-cluster.yaml

@@ -0,0 +1,62 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: ddb-cluster
+  namespace: ddb
+  labels:
+    app: postgresql
+    layer: data
+spec:
+  # 3-node cluster for HA
+  instances: 3
+
+  # PostgreSQL 16.2
+  imageName: ghcr.io/cloudnative-pg/postgresql:16.2
+
+  # Bootstrap: create app database + extensions
+  bootstrap:
+    initdb:
+      database: app
+      owner: app
+      encoding: UTF8
+      localeCollate: C
+      localeCType: C
+      postInitApplicationSQL:
+        - CREATE EXTENSION IF NOT EXISTS vector;
+        - CREATE EXTENSION IF NOT EXISTS pgcrypto;
+        - CREATE EXTENSION IF NOT EXISTS pg_trgm;
+
+  # Disable superuser (security)
+  enableSuperuserAccess: false
+
+  # PostgreSQL configuration
+  postgresql:
+    parameters:
+      shared_buffers: "256MB"
+      max_parallel_workers: "4"
+      max_parallel_workers_per_gather: "4"
+      # WAL archiving for backups
+      archive_mode: "on"
+      archive_timeout: "5min"
+      log_destination: "csvlog"
+      log_directory: "/controller/log"
+      log_filename: "postgres"
+      log_rotation_age: "0"
+      dynamic_shared_memory_type: "posix"
+
+  # Storage on Longhorn
+  storage:
+    size: 10Gi
+    storageClass: longhorn
+
+  # Monitoring
+  monitoring:
+    enablePodMonitor: false
+    disableDefaultQueries: false
+    customQueriesConfigMap:
+      - name: cnpg-default-monitoring
+        key: queries
+
+  # Pod anti-affinity for spreading replicas
+  affinity:
+    podAntiAffinityType: preferred