refactor(apps): split monolithic apps Kustomization into dependency waves

Replaces the single `apps` Flux Kustomization with dependency-ordered waves
(apps-wave-0..2) so a crashlooping workload isolates to its wave + downstream
instead of stalling the entire app tier. Parallel within a wave, ordered across.

- catalog/render.py: compute waves by longest dependency-path depth over the
  ServiceDefinition `dependencies:` edges (a `<svc>-db` is a leaf, so its
  consumer lands strictly higher — the "DB below consumer" rule falls out of
  longest-path, no special case). `--emit-waves` generates the per-wave
  kustomizations + Flux CRs; `--wave-layout` places renders into the right dir.
  wave 0: pihole gitea jackett plex qbittorrent nextcloud-db semaphore-db
  wave 1: sonarr radarr nextcloud semaphore gitea-actions
  wave 2: seerr
- apps/*.yaml -> apps/wave-{0,1,2}/ (byte-identical moves; SOPS files intact).
- clusters/base: apps.yaml removed; apps-wave-{0,1,2}.yaml added (dependsOn
  chain: platform-config -> wave-0 -> wave-1 -> wave-2, prune+wait each).
- clusters/dev: one SOPS decryption patch per wave (load-bearing).
- DESIGN-waves.md: wave table, topology, cutover runbook.

Cutover: preceded by disabling prune on `apps` (1bfb0db) so removing that
object here does not GC its resources; the wave Kustomizations SSA-adopt the
byte-identical manifests in place (no restart, no PVC churn).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

apps/README.md

@@ -1,3 +1,16 @@
 # apps
 
-_Placeholder — populated in Phase 0. See ../home-network-k3s (read-only spec)._
+App-tier manifests, rendered from `catalog/*.yaml` ServiceDefinitions by `catalog/render.py`
+and split into dependency-ordered **waves** (`wave-<N>/`).
+
+- Each `wave-<N>/` is reconciled by its own Flux Kustomization `apps-wave-<N>`
+  (`clusters/base/apps-wave-<N>.yaml`), which `dependsOn` wave N-1 (wave 0 dependsOn
+  `platform-config`) and health-gates (`wait: true`) ONLY that wave. A crashlooping workload
+  in a later wave can no longer stall an earlier wave or block new revisions.
+- `wave-<N>/kustomization.yaml` and `clusters/base/apps-wave-<N>.yaml` are **generated** — run
+  `python3 catalog/render.py --emit-waves` after onboarding a service; do not hand-edit them.
+- Wave assignment = longest dependency-path depth over the catalog `dependencies:` graph; a
+  co-located CNPG database `<svc>-db` is a leaf and always lands strictly below its consumer.
+
+See [`../DESIGN-waves.md`](../DESIGN-waves.md) for the wave table, Flux topology, and the
+cutover runbook.