feat(longhorn): auto-expand all volumes to 3 replicas via PostSync hook

Adds expand-replicas-job.yaml: PostSync hook Job that:
- Waits for all 3 Longhorn nodes to be Ready
- Patches every volume with numberOfReplicas < 3 to 3
- Runs idempotently on every longhorn-config sync (BeforeHookCreation
  deletes previous job, so re-runs are safe)

This ensures existing 1-replica volumes (created before the HA setup) get
expanded automatically via GitOps, not via manual kubectl patch.

Why PostSync: needs to run AFTER the taint-toleration setting and Node CRDs
are applied, otherwise there aren't 3 nodes available yet and the expansion
would fail (Longhorn can't create replicas on nodes that don't exist).

k8s/infrastructure/longhorn/kustomization.yaml

@@ -6,7 +6,9 @@ resources:
   - longhorn-servicemonitor.yaml
   - longhorn-taint-toleration.yaml
   - longhorn-nodes.yaml
+  - expand-replicas-job.yaml
 # Longhorn deployed via bootstrap script (cluster-config/longhorn_bootstrap.sh).
 # These manifests configure it post-bootstrap: WFFC StorageClass (default),
-# Prometheus ServiceMonitor, taint toleration for control-plane nodes, and
-# explicit Node CRDs for cp-2/cp-3 (auto-discovery doesn't work with taints).
+# Prometheus ServiceMonitor, taint toleration for control-plane nodes, explicit
+# Node CRDs for cp-2/cp-3, and a PostSync hook Job that expands all existing
+# volumes from 1→3 replicas (runs after nodes are Ready).