feat(apps): onboard semaphore (Phase 6) — second CNPG-DB + OIDC-target app

Semaphore (Ansible UI, docs/13 row 10): internal exposure, internet egress,
config on Longhorn + external PostgreSQL, auth oidc. Reuses the CNPG-DB pattern
nextcloud established (apps/nextcloud-db.yaml, commit 4be6752).

- catalog/semaphore.yaml: ServiceDefinition (schema >=1.2.0 env) wiring the
  SEMAPHORE_DB_* connection to semaphore-db-rw.semaphore-db:5432, break-glass
  SEMAPHORE_ADMIN* local admin, and the FIXED base64 SEMAPHORE_ACCESS_KEY_ENCRYPTION.
- apps/semaphore.yaml: rendered (render.py --no-image-automation) — Deployment,
  config PVC, Service, default-deny + egress/gateway/internet CNPs, HTTPRoute
  semaphore.home.keithjackson.dev:3000, ServiceMonitor, SLI alert.
- apps/semaphore-db.yaml: CNPG Cluster in dedicated ns semaphore-db, initdb from
  the owner secret, inheritedMetadata app.kubernetes.io/name=semaphore-db so the
  dep-edge egress CNP matches.
- apps/semaphore-db-app.sops.yaml + apps/semaphore-bootstrap-secret.sops.yaml:
  SOPS(age) owner creds (basic-auth) + mirrored db-password, break-glass admin,
  and the persistent access-key encryption key.

OIDC (Keycloak realm client) is DEFERRED like gitea/nextcloud — comes up on the
break-glass local admin; realm-client wiring is the batched follow-up.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

apps/semaphore-db.yaml

@@ -0,0 +1,75 @@
+---
+# Semaphore's PostgreSQL — a CloudNativePG Cluster (CR of the CNPG CRDs from platform/cnpg), modeled
+# on apps/nextcloud-db.yaml (the first CNPG-DB) / platform/keycloak/postgres-cluster.yaml. This is the
+# SECOND CNPG-DB in apps/, reusing the pattern established by nextcloud.
+#
+# WHY A DEDICATED `semaphore-db` NAMESPACE (not co-located in `semaphore`):
+#   The app->db edge in catalog/semaphore.yaml (`dependencies: to: semaphore-db`) compiles to a
+#   CiliumNetworkPolicy whose egress selector pins BOTH the destination pod label
+#   (app.kubernetes.io/name=semaphore-db) AND its namespace (k8s:io.kubernetes.pod.namespace=
+#   semaphore-db) — cross-namespace Cilium selectors must name the namespace (catalog/render.py
+#   r_dependency_policies). So the DB MUST live in a namespace literally named `semaphore-db` and its
+#   pods MUST carry app.kubernetes.io/name=semaphore-db, injected below via inheritedMetadata.
+#
+# DEFAULT-DENY POSTURE — mirrors keycloak/nextcloud-db (platform/keycloak/namespace.yaml): this
+# namespace is INTENTIONALLY not homelab.keithjackson.dev/app-namespace=true, so Kyverno does NOT
+# generate the app default-deny baseline here and CNPG runs under Cilium's cluster-wide default-allow —
+# the SAME posture the verified keycloak-db / nextcloud-db use. The semaphore SIDE keeps its
+# default-deny; its rendered egress-allow opens ONLY semaphore -> semaphore-db:5432, and the DB side's
+# default-allow accepts that reciprocal ingress. No app-namespace policy (auth-mode/host-namespace/
+# secret-provenance) is weakened.
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: semaphore-db
+  labels:
+    # Match the Cilium egress selector's namespace pin; NOT an app-namespace (see header).
+    app.kubernetes.io/name: semaphore-db
+---
+# Owner credentials for the CNPG cluster. SOPS-encrypted (age); type basic-auth so CNPG's initdb
+# consumes it as the `semaphore` role's password instead of generating a random one — this lets the
+# SAME password be mirrored into ns semaphore (semaphore-bootstrap/db-password) for the app's env,
+# since a Pod cannot read a Secret in another namespace. Provided as apps/semaphore-db-app.sops.yaml.
+#
+# CNPG Cluster (CR of postgresql.cnpg.io installed by platform/cnpg).
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: semaphore-db
+  namespace: semaphore-db
+spec:
+  # Single Postgres instance on 3-replica Longhorn is acceptable at home scale (ADR-0014, same as
+  # keycloak-db / nextcloud-db). The storage is already 3-way replicated by Longhorn; raise to 3 for
+  # Postgres-level HA as a future hardening.
+  instances: 1
+  imageName: ghcr.io/cloudnative-pg/postgresql:16.4
+  # Stamp app.kubernetes.io/name=semaphore-db onto every generated pod/service so the rendered
+  # semaphore egress CiliumNetworkPolicy's toEndpoints selector matches the primary pod (R-NET-02).
+  inheritedMetadata:
+    labels:
+      app.kubernetes.io/name: semaphore-db
+  storage:
+    storageClass: longhorn
+    size: 5Gi
+  bootstrap:
+    initdb:
+      database: semaphore
+      owner: semaphore
+      # Use the pre-provisioned owner secret (basic-auth) so its password is known + reusable by the
+      # app in the other namespace, instead of the random CNPG-generated one.
+      secret:
+        name: semaphore-db-app
+  # Emit Postgres metrics so Prometheus scrapes DB health (R-OBS-01). The CNPG operator creates the
+  # PodMonitor at runtime (CRD present from Phase-4 monitoring).
+  monitoring:
+    enablePodMonitor: true
+  resources:
+    requests:
+      cpu: 100m
+      memory: 256Mi
+    limits:
+      memory: 512Mi
+  # --- Off-cluster DR backup (R-STATE-03) — OPERATOR HAND-OFF (OQ-BKP, shared with Velero, Phase 4) ---
+  # When the off-cluster backup target is chosen, add a Barman object store + a ScheduledBackup here
+  # (same hand-off as keycloak-db / nextcloud-db). Until then the DB is protected by 3-replica Longhorn
+  # + (Phase-4) Velero PVC backups of the namespace; the SD declares backup.policy daily-offcluster.