refactor(k8s): consolidate to infra/+apps/ single-source tree, dedicated per-app CNPG (authentik-db/temporal-db), wire monitoring-config, forgejo→cicd ns, drop orphan/stale (data-schemas, ollama, story-crater, sqs/argocd, key-rotation)

k8s/bootstrap/phase3-forgejo/forgejo-db.yaml

@@ -5,7 +5,7 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: forgejo
+  name: cicd
   annotations:
     argocd.argoproj.io/sync-options: Prune=false
 ---
@@ -13,7 +13,7 @@ apiVersion: postgresql.cnpg.io/v1
 kind: Cluster
 metadata:
   name: forgejo-db
-  namespace: forgejo
+  namespace: cicd
   annotations:
     argocd.argoproj.io/sync-options: Prune=false  # Let ArgoCD adopt, don't delete
   labels:
@@ -71,15 +71,21 @@ spec:
     enablePodMonitor: true
 
   affinity:
-    podAntiAffinityType: required
+    # preferred (not required) so it can't deadlock if fewer than 3 nodes are
+    # schedulable; tolerations let CNPG pods land on control-plane nodes.
+    podAntiAffinityType: preferred
     topologyKey: kubernetes.io/hostname
+    tolerations:
+      - key: node-role.kubernetes.io/control-plane
+        operator: Exists
+        effect: NoSchedule
 ---
 # Forgejo Redis (cache, session, queue)
 apiVersion: v1
 kind: Service
 metadata:
   name: forgejo-redis
-  namespace: forgejo
+  namespace: cicd
   annotations:
     argocd.argoproj.io/sync-options: Prune=false
 spec:
@@ -95,7 +101,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: forgejo-redis
-  namespace: forgejo
+  namespace: cicd
   annotations:
     argocd.argoproj.io/sync-options: Prune=false
 spec:
@@ -108,6 +114,10 @@ spec:
       labels:
         app: forgejo-redis
     spec:
+      tolerations:
+        - key: node-role.kubernetes.io/control-plane
+          operator: Exists
+          effect: NoSchedule
       containers:
         - name: redis
           image: redis:7-alpine