feat: initial scaffold from helm-template

- Keycloak Operator v26 deployed to keycloak-system namespace
- Keycloak HA instance (2 replicas, jdbc-ping cluster discovery)
- Dedicated CNPG cluster (local-postgres storage, 2 instances)
- KeycloakRealmImport: home-lab realm with groups and traefik-oidc client
- Traefik IngressRoute: login.olb42.com (CF Access bypass)
- Admin credentials placeholder (seal before first deploy)
- ArgoCD ApplicationSets: login-operator + login

manifest/overlays/production/cnpg-cluster.yaml

@@ -0,0 +1,48 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: login-postgres
+  namespace: login
+spec:
+  # ── HA: 1 primary + 1 standby replica ────────────────────────────────────
+  instances: 2
+
+  # ── Storage: local-postgres class (fast local NVMe, no Longhorn overhead) ─
+  storage:
+    storageClass: local-postgres
+    size: 8Gi
+
+  # ── Spread replicas across nodes ──────────────────────────────────────────
+  affinity:
+    enablePodAntiAffinity: true
+    topologyKey: kubernetes.io/hostname
+
+  # ── Bootstrap: create the keycloak database and owner role ───────────────
+  bootstrap:
+    initdb:
+      database: keycloak
+      owner: keycloak
+
+  # ── WAL archival via barman-cloud → MinIO ─────────────────────────────────
+  plugins:
+    - name: barman-cloud.cloudnative-pg.io
+      isWALArchiver: true
+      parameters:
+        barmanObjectName: minio-store
+
+  # ── PostgreSQL tuning for Keycloak workload ───────────────────────────────
+  postgresql:
+    parameters:
+      max_connections: "200"
+      shared_buffers: "256MB"
+      work_mem: "8MB"
+      maintenance_work_mem: "64MB"
+
+  # ── Resources ─────────────────────────────────────────────────────────────
+  resources:
+    requests:
+      memory: 256Mi
+      cpu: 100m
+    limits:
+      memory: 512Mi
+      cpu: 500m