feat(data): Add CNPG cluster + database schema initialization

Create production PostgreSQL cluster via CNPG (3-node HA, Longhorn storage).

Schema initialization Job creates schemas for:
- Authentik (identity provider)
- Temporal (workflow engine)
- Vault (secrets management)
- App (generic application databases)

Database layer now captures complete IaC for stateful infrastructure.
Services find ready schemas when deployed.

k8s/data/schemas.yaml

@@ -0,0 +1,36 @@
+---
+# Schema initialization ConfigMap for PostgreSQL services
+# Services: Authentik, Vault (optional), Temporal, others
+# Applied via initdb Jobs after CNPG cluster is ready
+
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: db-schemas
+  namespace: ddb
+  labels:
+    app: postgresql-schemas
+data:
+  # Authentik schema (minimal — Authentik creates most tables via Django ORM)
+  authentik-init.sql: |
+    CREATE SCHEMA IF NOT EXISTS authentik;
+    GRANT USAGE ON SCHEMA authentik TO app;
+    GRANT CREATE ON SCHEMA authentik TO app;
+
+  # Temporal schema
+  temporal-init.sql: |
+    CREATE SCHEMA IF NOT EXISTS temporal;
+    GRANT USAGE ON SCHEMA temporal TO app;
+    GRANT CREATE ON SCHEMA temporal TO app;
+
+  # Vault schema (if using PostgreSQL backend)
+  vault-init.sql: |
+    CREATE SCHEMA IF NOT EXISTS vault;
+    GRANT USAGE ON SCHEMA vault TO app;
+    GRANT CREATE ON SCHEMA vault TO app;
+
+  # Application schema (generic)
+  app-init.sql: |
+    -- Default app schema (public)
+    GRANT USAGE ON SCHEMA public TO app;
+    GRANT CREATE ON SCHEMA public TO app;