feat!: replace postgresql-ha with CloudNativePG

The bundled `postgresql-ha` sub-chart was the only HA-ready database option, but it pinned us to a Bitnami chart
whose images are no longer freely distributed, and it bundled repmgr and pgpool into the release. Operating a
Postgres cluster through a Helm release also means the chart has to reimplement failover, backup and upgrade
orchestration that a dedicated operator already solves.

CloudNativePG is the de-facto standard operator for Postgres on Kubernetes and handles instance management,
streaming replication, switchover and rolling upgrades itself. The operator is deliberately *not* part of this
chart: cluster-scoped CRDs and controllers do not belong into an application release and would conflict with an
operator that is already installed. The chart only renders the namespaced `Cluster` resource, so the operator can
be managed independently.

Because the operator cannot be assumed to be present, `cloudnativePG.enabled` defaults to `false`. Existing users
of `postgresql` or an external database are therefore unaffected.

Credentials follow the chart-wide `secrets.*` convention. Only the password is read from a Secret, because
CloudNativePG requires `bootstrap.initdb.database` and `bootstrap.initdb.owner` as literals in the `Cluster` spec
and cannot resolve them from a Secret. The password is injected into the `init-app-ini` container as
`GITEA__database__PASSWD` instead of being written into the generated `app.ini`.

BREAKING CHANGE: The `postgresql-ha` sub-chart and all `postgresql-ha.*` values have been removed. There is no
in-place migration path between the two deployments: dump the database of the old `postgresql-ha` release with
`pg_dump`, remove the `postgresql-ha` values, deploy the chart with `cloudnativePG.enabled=true` and restore the
dump. Setting `postgresql-ha` now fails the release with a pointer to the changelog.

Co-authored-by: Copilot <copilot@github.com>

templates/cluster.yaml

@@ -0,0 +1,45 @@
+{{- if .Values.cloudnativePG.enabled -}}
+{{- $registry := .Values.global.imageRegistry | default .Values.cloudnativePG.image.registry -}}
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  {{- with (include "gitea.cluster.cloudnativePG.annotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
+  labels:
+    {{- include "gitea.cluster.cloudnativePG.labels" . | nindent 4 }}
+  name: {{ include "gitea.cluster.cloudnativePG.name" . }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
+spec:
+  affinity:
+    {{- toYaml .Values.cloudnativePG.affinity | nindent 4 }}
+  bootstrap:
+    initdb:
+      database: {{ .Values.cloudnativePG.credentials.database | quote }}
+      owner: {{ .Values.cloudnativePG.credentials.username | quote }}
+      secret:
+        name: {{ include "gitea.secret.cloudnativePG.name" . }}
+  imageName: {{ printf "%s/%s:%s" $registry .Values.cloudnativePG.image.repository (.Values.cloudnativePG.image.tag | toString) | quote }}
+  instances: {{ .Values.cloudnativePG.instances }}
+  monitoring:
+    enablePodMonitor: {{ .Values.cloudnativePG.monitoring.enablePodMonitor }}
+  postgresql:
+    parameters:
+      {{- toYaml .Values.cloudnativePG.postgresql.parameters | nindent 6 }}
+  priorityClassName: {{ .Values.cloudnativePG.priorityClassName | quote }}
+  resources:
+    {{- toYaml .Values.cloudnativePG.resources | nindent 4 }}
+  storage:
+    size: {{ .Values.cloudnativePG.storage.size | quote }}
+    {{- with .Values.cloudnativePG.storage.storageClass }}
+    storageClass: {{ . | quote }}
+    {{- end }}
+  {{- if .Values.cloudnativePG.walStorage.enabled }}
+  walStorage:
+    size: {{ .Values.cloudnativePG.walStorage.size | quote }}
+    {{- with .Values.cloudnativePG.walStorage.storageClass }}
+    storageClass: {{ . | quote }}
+    {{- end }}
+  {{- end }}
+{{- end -}}