refactor(apps): split monolithic apps Kustomization into dependency waves

Replaces the single `apps` Flux Kustomization with dependency-ordered waves
(apps-wave-0..2) so a crashlooping workload isolates to its wave + downstream
instead of stalling the entire app tier. Parallel within a wave, ordered across.

- catalog/render.py: compute waves by longest dependency-path depth over the
  ServiceDefinition `dependencies:` edges (a `<svc>-db` is a leaf, so its
  consumer lands strictly higher — the "DB below consumer" rule falls out of
  longest-path, no special case). `--emit-waves` generates the per-wave
  kustomizations + Flux CRs; `--wave-layout` places renders into the right dir.
  wave 0: pihole gitea jackett plex qbittorrent nextcloud-db semaphore-db
  wave 1: sonarr radarr nextcloud semaphore gitea-actions
  wave 2: seerr
- apps/*.yaml -> apps/wave-{0,1,2}/ (byte-identical moves; SOPS files intact).
- clusters/base: apps.yaml removed; apps-wave-{0,1,2}.yaml added (dependsOn
  chain: platform-config -> wave-0 -> wave-1 -> wave-2, prune+wait each).
- clusters/dev: one SOPS decryption patch per wave (load-bearing).
- DESIGN-waves.md: wave table, topology, cutover runbook.

Cutover: preceded by disabling prune on `apps` (1bfb0db) so removing that
object here does not GC its resources; the wave Kustomizations SSA-adopt the
byte-identical manifests in place (no restart, no PVC churn).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

bootstrap/flux/patches/apps-sops-decryption.yaml

@@ -1,18 +1,19 @@
 ---
-# Enable SOPS decryption on the `apps` Flux Kustomization (ADR-0007, R-SEC-01).
+# Enable SOPS decryption on the app-tier Flux Kustomizations (ADR-0007, R-SEC-01).
 #
-# REALISES the commented TODO in clusters/base/apps.yaml (same pattern as the platform patch).
-# Strategic-merge patch — adds the decryption stanza to the base `apps` Kustomization without
-# forking it (R-ENV-02). `sops-age` Secret referenced BY NAME ONLY (created out-of-band).
+# The app tier is now dependency-ordered WAVES (apps-wave-0..N), not a single `apps`
+# Kustomization — so decryption is layered onto EACH wave, by name. clusters/dev inlines one
+# such stanza per wave (see clusters/dev/kustomization.yaml); this file documents the shape.
+# Strategic-merge patch — adds the decryption stanza without forking the base (R-ENV-02).
+# `sops-age` Secret referenced BY NAME ONLY (created out-of-band).
 #
-# WIRING (clusters owner / PM): add to clusters/dev/kustomization.yaml `patches:` alongside the
-# platform patch, e.g.
-#     patches:
-#       - path: ../../bootstrap/flux/patches/apps-sops-decryption.yaml
+# WIRING (clusters owner / PM): the dev overlay carries one inlined patch per wave. When
+# `render.py --emit-waves` introduces a NEW deepest wave, add a matching stanza there
+# (metadata.name: apps-wave-<N>). Below is the template for a single wave (wave 0 shown):
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: apps
+  name: apps-wave-0
   namespace: flux-system
 spec:
   decryption: