refactor(k8s): consolidate to infra/+apps/ single-source tree, dedicated per-app CNPG (authentik-db/temporal-db), wire monitoring-config, forgejo→cicd ns, drop orphan/stale (data-schemas, ollama, story-crater, sqs/argocd, key-rotation)

k8s/argocd/apps/40-data.yaml

@@ -1,24 +1,28 @@
-# Wave 6 — Database schemas + init jobs.
-# CNPG operator and ddb-cluster are bootstrap-only (k8s/bootstrap-local/).
-# This app manages ONLY the per-app databases and schema initialization.
-# Dependencies: ddb-cluster (bootstrap wave 0), SOPS secrets (wave 4)
+# Wave 2 — dedicated per-app CNPG Postgres clusters (authentik-db → ns iam,
+# temporal-db + visibility → ns temporal). ONE App, ONE folder (k8s/infra/databases).
+# CNPG operator is Phase-0 bootstrap; these Cluster CRs are GitOps — no circular
+# dep (they run after ArgoCD is up, before their apps at w3/w8). CNPG generates
+# each cluster's `<name>-app` secret + `<name>-rw` service in-namespace; the apps
+# read them locally. Forgejo's DB stays separate (bootstrap/circular).
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: data-schemas
+  name: databases
   namespace: argocd
   annotations:
-    argocd.argoproj.io/sync-wave: "6"
+    argocd.argoproj.io/sync-wave: "2"
 spec:
   project: homelab
   source:
     repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
     targetRevision: main
-    path: k8s/data/schemas  # CHANGED from k8s/data to avoid ddb-cluster duplication
+    path: k8s/infra/databases
   destination:
     server: https://kubernetes.default.svc
-    namespace: ddb
+    namespace: default
   syncPolicy:
     automated:
       prune: true
       selfHeal: true
+    syncOptions:
+      - ServerSideApply=true