feat!: replace postgresql-ha with CloudNativePG

The bundled `postgresql-ha` sub-chart was the only HA-ready database option, but it pinned us to a Bitnami chart
whose images are no longer freely distributed, and it bundled repmgr and pgpool into the release. Operating a
Postgres cluster through a Helm release also means the chart has to reimplement failover, backup and upgrade
orchestration that a dedicated operator already solves.

CloudNativePG is the de-facto standard operator for Postgres on Kubernetes and handles instance management,
streaming replication, switchover and rolling upgrades itself. The operator is deliberately *not* part of this
chart: cluster-scoped CRDs and controllers do not belong into an application release and would conflict with an
operator that is already installed. The chart only renders the namespaced `Cluster` resource, so the operator can
be managed independently.

Because the operator cannot be assumed to be present, `cloudnativePG.enabled` defaults to `false`. Existing users
of `postgresql` or an external database are therefore unaffected.

Credentials follow the chart-wide `secrets.*` convention. Only the password is read from a Secret, because
CloudNativePG requires `bootstrap.initdb.database` and `bootstrap.initdb.owner` as literals in the `Cluster` spec
and cannot resolve them from a Secret. The password is injected into the `init-app-ini` container as
`GITEA__database__PASSWD` instead of being written into the generated `app.ini`.

BREAKING CHANGE: The `postgresql-ha` sub-chart and all `postgresql-ha.*` values have been removed. There is no
in-place migration path between the two deployments: dump the database of the old `postgresql-ha` release with
`pg_dump`, remove the `postgresql-ha` values, deploy the chart with `cloudnativePG.enabled=true` and restore the
dump. Setting `postgresql-ha` now fails the release with a pointer to the changelog.

Co-authored-by: Copilot <copilot@github.com>

unittests/helm/cluster/basics.yaml

@@ -0,0 +1,131 @@
+suite: Test cluster basics
+release:
+  name: gitea-unittests
+  namespace: testing
+tests:
+  - it: "Render nothing when cloudnativePG is disabled"
+    templates:
+      - templates/cluster.yaml
+      - templates/secret_cloudnativePG.yaml
+    set:
+      cloudnativePG:
+        enabled: false
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: "Render the Cluster with the default values"
+    template: templates/cluster.yaml
+    set:
+      cloudnativePG:
+        enabled: true
+    asserts:
+      - containsDocument:
+          kind: Cluster
+          apiVersion: postgresql.cnpg.io/v1
+          name: gitea-unittests-postgresql
+          namespace: testing
+      - equal:
+          path: spec.instances
+          value: 3
+      - equal:
+          path: spec.imageName
+          value: "ghcr.io/cloudnative-pg/postgresql:18.0"
+      - equal:
+          path: spec.bootstrap.initdb
+          value:
+            database: "gitea"
+            owner: "gitea"
+            secret:
+              name: gitea-unittests-postgresql-app
+      - equal:
+          path: spec.storage.size
+          value: "10Gi"
+      - notExists:
+          path: spec.storage.storageClass
+      - notExists:
+          path: spec.walStorage
+
+  - it: "Render the credential Secret with the default values"
+    template: templates/secret_cloudnativePG.yaml
+    set:
+      cloudnativePG:
+        enabled: true
+    asserts:
+      - containsDocument:
+          kind: Secret
+          apiVersion: v1
+          name: gitea-unittests-postgresql-app
+          namespace: testing
+      - equal:
+          path: type
+          value: kubernetes.io/basic-auth
+      - equal:
+          path: data.password
+          decodeBase64: true
+          value: "gitea"
+      - equal:
+          path: data.username
+          decodeBase64: true
+          value: "gitea"
+      - notExists:
+          path: data.database
+      - notExists:
+          path: stringData
+
+  - it: "Render no credential Secret when an existing Secret is used"
+    template: templates/secret_cloudnativePG.yaml
+    set:
+      cloudnativePG:
+        enabled: true
+        credentials:
+          existingSecret:
+            enabled: true
+            secretName: my-credentials
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: "Reference the existing Secret in the Cluster"
+    template: templates/cluster.yaml
+    set:
+      cloudnativePG:
+        enabled: true
+        credentials:
+          existingSecret:
+            enabled: true
+            secretName: my-credentials
+          database: my-database
+          username: my-username
+    asserts:
+      - equal:
+          path: spec.bootstrap.initdb
+          value:
+            database: "my-database"
+            owner: "my-username"
+            secret:
+              name: my-credentials
+
+  - it: "Apply the storage and walStorage customizations"
+    template: templates/cluster.yaml
+    set:
+      cloudnativePG:
+        enabled: true
+        storage:
+          size: 1337Mi
+          storageClass: my-storage-class
+        walStorage:
+          enabled: true
+          size: 42Mi
+          storageClass: my-wal-storage-class
+    asserts:
+      - equal:
+          path: spec.storage
+          value:
+            size: "1337Mi"
+            storageClass: "my-storage-class"
+      - equal:
+          path: spec.walStorage
+          value:
+            size: "42Mi"
+            storageClass: "my-wal-storage-class"