refactor(apps): split monolithic apps Kustomization into dependency waves

Replaces the single `apps` Flux Kustomization with dependency-ordered waves
(apps-wave-0..2) so a crashlooping workload isolates to its wave + downstream
instead of stalling the entire app tier. Parallel within a wave, ordered across.

- catalog/render.py: compute waves by longest dependency-path depth over the
  ServiceDefinition `dependencies:` edges (a `<svc>-db` is a leaf, so its
  consumer lands strictly higher — the "DB below consumer" rule falls out of
  longest-path, no special case). `--emit-waves` generates the per-wave
  kustomizations + Flux CRs; `--wave-layout` places renders into the right dir.
  wave 0: pihole gitea jackett plex qbittorrent nextcloud-db semaphore-db
  wave 1: sonarr radarr nextcloud semaphore gitea-actions
  wave 2: seerr
- apps/*.yaml -> apps/wave-{0,1,2}/ (byte-identical moves; SOPS files intact).
- clusters/base: apps.yaml removed; apps-wave-{0,1,2}.yaml added (dependsOn
  chain: platform-config -> wave-0 -> wave-1 -> wave-2, prune+wait each).
- clusters/dev: one SOPS decryption patch per wave (load-bearing).
- DESIGN-waves.md: wave table, topology, cutover runbook.

Cutover: preceded by disabling prune on `apps` (1bfb0db) so removing that
object here does not GC its resources; the wave Kustomizations SSA-adopt the
byte-identical manifests in place (no restart, no PVC churn).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

clusters/README.md

@@ -16,7 +16,9 @@ clusters/
   base/                 shared Flux objects (one authoring, both environments)
     flux-system.yaml    GitRepository — the reconciliation source (bootstrap → Gitea)
     platform.yaml       Flux Kustomization → ./platform   (reconciles first)
-    apps.yaml           Flux Kustomization → ./apps        (dependsOn platform)
+    apps-wave-0.yaml    Flux Kustomization → ./apps/wave-0 (dependsOn platform-config)
+    apps-wave-1.yaml    Flux Kustomization → ./apps/wave-1 (dependsOn apps-wave-0)
+    apps-wave-2.yaml    Flux Kustomization → ./apps/wave-N (dependsOn apps-wave-N-1)
     cluster-vars.yaml   ConfigMap of overlay knobs (BASE defaults)
     kustomization.yaml
   dev/                  ACTIVE build target — patches cluster-vars with dev values only
@@ -60,10 +62,20 @@ GitRepository (flux-system)
 Kustomization: platform  (./platform, substituteFrom cluster-vars)
         │  healthy
         ▼
-Kustomization: apps      (./apps, dependsOn platform, substituteFrom cluster-vars)
+Kustomization: apps-wave-0  (./apps/wave-0, dependsOn platform-config, substituteFrom cluster-vars)
+        │  healthy
+        ▼
+Kustomization: apps-wave-1  (./apps/wave-1, dependsOn apps-wave-0)
+        │  healthy
+        ▼
+Kustomization: apps-wave-N  (./apps/wave-N, dependsOn apps-wave-N-1)
 ```
 
-`apps` `dependsOn` `platform` so CNI/storage/TLS/DNS/gateway exist before any workload reconciles.
+Wave 0 `dependsOn` `platform-config` (transitively `platform`) so CNI/storage/TLS/DNS/gateway
+exist before any workload reconciles. The app tier is split into dependency-ordered WAVES
+(`catalog/render.py --emit-waves`): each `apps-wave-<N>` health-gates (wait:true) ONLY its own
+wave, so a crashloop in a later wave can no longer stall an earlier wave or block new revisions.
+See [DESIGN-waves.md](../DESIGN-waves.md) for the wave table + cutover runbook.
 
 ## TODOs (later phases — do not action in Phase 0)