fix: three blocking issues preventing login stack from starting

- keycloak-instance: bootstrapAdminSpec -> bootstrapAdmin (correct CRD field)
- cnpg-cluster: remove barman-cloud plugin block (BarmanObjectStore CRD absent)
- operator/kustomization: patch WATCH_NAMESPACES=login so operator reconciles login ns

manifest/overlays/production/cnpg-cluster.yaml

@@ -23,12 +23,8 @@ spec:
       database: keycloak
       owner: keycloak
 
-  # ── WAL archival via barman-cloud → MinIO ─────────────────────────────────
-  plugins:
-    - name: barman-cloud.cloudnative-pg.io
-      isWALArchiver: true
-      parameters:
-        barmanObjectName: minio-store
+  # WAL archival (barman-cloud → MinIO) intentionally omitted until BarmanObjectStore
+  # CRD is confirmed present in this cluster. Add back via plugins block once verified.
 
   # ── PostgreSQL tuning for Keycloak workload ───────────────────────────────
   postgresql:

manifest/overlays/production/keycloak-instance.yaml

@@ -45,7 +45,7 @@ spec:
     headers: forwarded
 
   # ── Bootstrap admin credentials (sealed secret — see admin.sealed.secret.yaml)
-  bootstrapAdminSpec:
+  bootstrapAdmin:
     secret:
       name: login-admin