feat: add paperless-ngx with OIDC, CNPG db, cp-3 HDD media, MinIO backup

Fixes controlplane.tftpl's install.wipe:true (should be false, live CPs already run false) and syncs coredns Corefile back to what's actually deployed (drops an unrolled-out, stale Kong-era rewrite).

k8s/infra/databases/kustomization.yaml

@@ -1,10 +1,12 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 # Dedicated per-app CNPG clusters. NO top-level `namespace:` — each Cluster
-# carries its own ns (iam / temporal / poimen); a transformer would wrongly collapse them.
-# poimen ns created by poimen-root app, memory-db deployed into it.
+# carries its own ns (iam / temporal / poimen / paperless); a transformer would
+# wrongly collapse them. poimen ns created by poimen-root app, memory-db
+# deployed into it. paperless ns declared in namespaces.yaml above.
 resources:
   - namespaces.yaml
   - authentik-db.yaml
   - temporal-db.yaml
   - memory-db.yaml
+  - paperless-db.yaml

k8s/infra/databases/namespaces.yaml

@@ -1,7 +1,7 @@
 # DB clusters are wave 2 — their namespaces must exist first (their apps that
 # would CreateNamespace run later, w3/w8). Declared here so the databases App
-# creates them. authentik/vault/temporal CreateNamespace=true then no-ops.
-# poimen namespace created by poimen-root app (wave 7).
+# creates them. authentik/vault/temporal/paperless CreateNamespace=true then
+# no-ops. poimen namespace created by poimen-root app (wave 7).
 apiVersion: v1
 kind: Namespace
 metadata:
@@ -11,3 +11,8 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: temporal
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: paperless

k8s/infra/databases/paperless-db.yaml

@@ -0,0 +1,36 @@
+# Dedicated CNPG Postgres for paperless-ngx (GitOps, wave 2 — before the
+# paperless app at w8). Same recipe as memory-db: default longhorn storage
+# class (3 replicas), 2 instances, 20Gi.
+# CNPG generates secret `paperless-db-app` + service `paperless-db-rw` in ns
+# paperless; the paperless Deployment reads them locally.
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: paperless-db
+  namespace: paperless
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+spec:
+  instances: 2
+  imageName: ghcr.io/cloudnative-pg/postgresql:16.2
+  bootstrap:
+    initdb:
+      database: paperless
+      owner: app
+      encoding: UTF8
+      localeCollate: C
+      localeCType: C
+  enableSuperuserAccess: false
+  resources:
+    requests: { memory: "512Mi", cpu: "250m" }
+    limits: { memory: "2Gi", cpu: "1" }
+  storage:
+    size: 20Gi
+    storageClass: longhorn
+  affinity:
+    podAntiAffinityType: preferred
+    topologyKey: kubernetes.io/hostname
+    tolerations:
+      - key: node-role.kubernetes.io/control-plane
+        operator: Exists
+        effect: NoSchedule