feat: add shared PostgreSQL instance for platform components

Adds charts/postgresql: one shared PostgreSQL 18.6 instance, with one database and one owning role per component. It's enabled in the umbrella chart, but databases is empty, so it deploys an empty Postgres.

Deploys: StatefulSet postgres (1 replica), PVCs data-postgres-0 (1Gi) and backups-postgres-0 (2Gi), Services postgres and postgres-headless, Secret postgres-credentials, and a NetworkPolicy. Two things appear only when a database is listed: the provisioning Job, and the backup CronJob (backup.enabled, off by default). kind uses storageClass: standard and has no NetworkPolicy.

How it works

• Adding a database: add an entry to postgresql.databases and run helm upgrade. An idempotent Job creates the role and database, re-applies the password, and revokes PUBLIC access. It runs again on every install, upgrade and rollback.
• Passwords: generated on first install and kept across upgrades through lookup. The Secret survives helm uninstall.
• Security: runs as a non-root user with a read-only filesystem and all capabilities dropped; passwords use scram-sha-256. Database and user names are validated before they go into SQL, and passwords are passed as psql variables.
• Backups: optional nightly pg_dumpall --globals-only plus a pg_dump per database, with a retention period. Restore steps are in the README.

Test

helm lint oop-platform-chart -f environments/kind/values.yaml
./deploy-on-kind.sh && kubectl -n oop get sts,pvc,svc -l app.kubernetes.io/component=database
helm upgrade oop-platform ./oop-platform-chart -n oop -f environments/kind/values.yaml \
  --set 'postgresql.databases[0].name=demo,postgresql.databases[0].user=demo'
kubectl -n oop logs -l app.kubernetes.io/name=postgres-provision

• Lint and render pass (base and kind values); no other subchart changed
• Invalid database names fail rendering
• Deployed on kind; provisioning Job completes