feat(apps): onboard semaphore (Phase 6) — second CNPG-DB + OIDC-target app

Semaphore (Ansible UI, docs/13 row 10): internal exposure, internet egress,
config on Longhorn + external PostgreSQL, auth oidc. Reuses the CNPG-DB pattern
nextcloud established (apps/nextcloud-db.yaml, commit 4be6752).

- catalog/semaphore.yaml: ServiceDefinition (schema >=1.2.0 env) wiring the
  SEMAPHORE_DB_* connection to semaphore-db-rw.semaphore-db:5432, break-glass
  SEMAPHORE_ADMIN* local admin, and the FIXED base64 SEMAPHORE_ACCESS_KEY_ENCRYPTION.
- apps/semaphore.yaml: rendered (render.py --no-image-automation) — Deployment,
  config PVC, Service, default-deny + egress/gateway/internet CNPs, HTTPRoute
  semaphore.home.keithjackson.dev:3000, ServiceMonitor, SLI alert.
- apps/semaphore-db.yaml: CNPG Cluster in dedicated ns semaphore-db, initdb from
  the owner secret, inheritedMetadata app.kubernetes.io/name=semaphore-db so the
  dep-edge egress CNP matches.
- apps/semaphore-db-app.sops.yaml + apps/semaphore-bootstrap-secret.sops.yaml:
  SOPS(age) owner creds (basic-auth) + mirrored db-password, break-glass admin,
  and the persistent access-key encryption key.

OIDC (Keycloak realm client) is DEFERRED like gitea/nextcloud — comes up on the
break-glass local admin; realm-client wiring is the batched follow-up.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

apps/kustomization.yaml

@@ -21,6 +21,10 @@ resources:
   - nextcloud-db.yaml                      # CNPG PostgreSQL Cluster (ns nextcloud-db) — first CNPG-DB app
   - nextcloud-db-app.sops.yaml             # SOPS: CNPG owner credentials (basic-auth) for initdb
   - nextcloud-bootstrap-secret.sops.yaml   # SOPS: break-glass admin + mirrored db-password (ns nextcloud)
+  - semaphore.yaml
+  - semaphore-db.yaml                      # CNPG PostgreSQL Cluster (ns semaphore-db) — second CNPG-DB app
+  - semaphore-db-app.sops.yaml             # SOPS: CNPG owner credentials (basic-auth) for initdb
+  - semaphore-bootstrap-secret.sops.yaml   # SOPS: break-glass admin + mirrored db-password + access-key-encryption (ns semaphore)
 # Gitea's headless-install env + break-glass admin postStart hook are now first-class in the
 # ServiceDefinition (catalog/gitea.yaml env/lifecycle, schema >=1.2.0) and rendered inline into
 # apps/gitea.yaml, so the former gitea-bootstrap-patch.yaml strategic-merge patch is retired.