refactor(k8s): consolidate to infra/+apps/ single-source tree, dedicated per-app CNPG (authentik-db/temporal-db), wire monitoring-config, forgejo→cicd ns, drop orphan/stale (data-schemas, ollama, story-crater, sqs/argocd, key-rotation)

k8s/infra/databases/authentik-db.yaml

@@ -0,0 +1,38 @@
+# Dedicated CNPG Postgres for Authentik (GitOps, wave 2 — before authentik w3).
+# CNPG generates secret `authentik-db-app` + service `authentik-db-rw` in ns iam;
+# authentik-values reads them locally (no cross-ns secret copy).
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: authentik-db
+  namespace: iam
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+spec:
+  instances: 3
+  imageName: ghcr.io/cloudnative-pg/postgresql:16.2
+  bootstrap:
+    initdb:
+      database: authentik
+      owner: app
+      encoding: UTF8
+      localeCollate: C
+      localeCType: C
+  enableSuperuserAccess: false
+  resources:
+    requests: { memory: "512Mi", cpu: "250m" }
+    limits: { memory: "2Gi", cpu: "1" }
+  storage:
+    size: 10Gi
+    storageClass: longhorn-cnpg
+  monitoring:
+    enablePodMonitor: true
+  affinity:
+    # preferred + tolerations: HA across nodes without deadlocking a partly-
+    # schedulable 3-CP (same as forgejo-db).
+    podAntiAffinityType: preferred
+    topologyKey: kubernetes.io/hostname
+    tolerations:
+      - key: node-role.kubernetes.io/control-plane
+        operator: Exists
+        effect: NoSchedule

k8s/infra/databases/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+# Dedicated per-app CNPG clusters. NO top-level `namespace:` — each Cluster
+# carries its own ns (iam / temporal); a transformer would wrongly collapse them.
+resources:
+  - namespaces.yaml
+  - authentik-db.yaml
+  - temporal-db.yaml

k8s/infra/databases/namespaces.yaml

@@ -0,0 +1,12 @@
+# DB clusters are wave 2 — their namespaces must exist first (their apps that
+# would CreateNamespace run later, w3/w8). Declared here so the databases App
+# creates them. authentik/vault/temporal CreateNamespace=true then no-ops.
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: iam
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: temporal

k8s/infra/databases/temporal-db.yaml

@@ -0,0 +1,49 @@
+# Dedicated CNPG Postgres for Temporal (GitOps, wave 2 — before temporal w8).
+# Temporal needs TWO databases: `temporal` (initdb) + `temporal_visibility`
+# (Database CR). CNPG generates secret `temporal-db-app` + service
+# `temporal-db-rw` in ns temporal; temporal-values reads them locally.
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: temporal-db
+  namespace: temporal
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+spec:
+  instances: 3
+  imageName: ghcr.io/cloudnative-pg/postgresql:16.2
+  bootstrap:
+    initdb:
+      database: temporal
+      owner: app
+      encoding: UTF8
+      localeCollate: C
+      localeCType: C
+  enableSuperuserAccess: false
+  resources:
+    requests: { memory: "512Mi", cpu: "250m" }
+    limits: { memory: "2Gi", cpu: "1" }
+  storage:
+    size: 10Gi
+    storageClass: longhorn-cnpg
+  monitoring:
+    enablePodMonitor: true
+  affinity:
+    podAntiAffinityType: preferred
+    topologyKey: kubernetes.io/hostname
+    tolerations:
+      - key: node-role.kubernetes.io/control-plane
+        operator: Exists
+        effect: NoSchedule
+---
+# Second database Temporal requires (visibility store), on the same cluster.
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: temporal-visibility
+  namespace: temporal
+spec:
+  name: temporal_visibility
+  owner: app
+  cluster:
+    name: temporal-db