refactor(apps): split monolithic apps Kustomization into dependency waves

Replaces the single `apps` Flux Kustomization with dependency-ordered waves
(apps-wave-0..2) so a crashlooping workload isolates to its wave + downstream
instead of stalling the entire app tier. Parallel within a wave, ordered across.

- catalog/render.py: compute waves by longest dependency-path depth over the
  ServiceDefinition `dependencies:` edges (a `<svc>-db` is a leaf, so its
  consumer lands strictly higher — the "DB below consumer" rule falls out of
  longest-path, no special case). `--emit-waves` generates the per-wave
  kustomizations + Flux CRs; `--wave-layout` places renders into the right dir.
  wave 0: pihole gitea jackett plex qbittorrent nextcloud-db semaphore-db
  wave 1: sonarr radarr nextcloud semaphore gitea-actions
  wave 2: seerr
- apps/*.yaml -> apps/wave-{0,1,2}/ (byte-identical moves; SOPS files intact).
- clusters/base: apps.yaml removed; apps-wave-{0,1,2}.yaml added (dependsOn
  chain: platform-config -> wave-0 -> wave-1 -> wave-2, prune+wait each).
- clusters/dev: one SOPS decryption patch per wave (load-bearing).
- DESIGN-waves.md: wave table, topology, cutover runbook.

Cutover: preceded by disabling prune on `apps` (1bfb0db) so removing that
object here does not GC its resources; the wave Kustomizations SSA-adopt the
byte-identical manifests in place (no restart, no PVC churn).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

clusters/base/kustomization.yaml

@@ -7,5 +7,12 @@ resources:
   - flux-system.yaml     # GitRepository (reconciliation source)
   - platform.yaml        # Flux Kustomization -> ./platform (CONTROLLERS: HelmReleases / CRDs)
   - platform-config.yaml # Flux Kustomization -> ./platform-config (CONFIGS: CRs; dependsOn platform)
-  - apps.yaml            # Flux Kustomization -> ./apps (dependsOn platform-config)
+  # App tier, split into dependency-ordered WAVES (was the single ./apps `apps` Kustomization).
+  # Each apps-wave-<N> dependsOn wave N-1 (wave 0 dependsOn platform-config) and health-gates
+  # (wait:true) ONLY its own wave, so a crashloop in a later wave can't stall an earlier one.
+  # GENERATED by `catalog/render.py --emit-waves`; add a line here only when a NEW deepest wave
+  # is introduced (a service deeper than any existing wave). See DESIGN-waves.md.
+  - apps-wave-0.yaml     # Flux Kustomization -> ./apps/wave-0 (dependsOn platform-config)
+  - apps-wave-1.yaml     # Flux Kustomization -> ./apps/wave-1 (dependsOn apps-wave-0)
+  - apps-wave-2.yaml     # Flux Kustomization -> ./apps/wave-2 (dependsOn apps-wave-1)
   - cluster-vars.yaml    # overlay knob surface (base defaults)