feat(sso-mfa): T03 PostgreSQL manifests (NK-WP-0001-T03)

CloudNativePG Cluster CR (net-kingdom-pg, PostgreSQL 16) with two
application databases: keycloak_db (owner: keycloak) and privacyidea_db
(owner: privacyidea). Passwords managed continuously via managed.roles.
WAL archiving section stubbed and commented; activate when object storage
is available. ScheduledBackup CR included (daily 02:00 UTC, 7d retention).

Also: sync workplan status for T01 (Phase 0a done), T02 (manifests done),
T03 (manifests done, restore drill pending); close NK-WP-0002.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

workplans/NK-WP-0002-local-identity.md

@@ -3,12 +3,12 @@ id: NK-WP-0002
 type: workplan
 title: "Local Identity — Bootstrap User Store & Minimal OIDC"
 domain: netkingdom
-status: active
+status: completed
 owner: worsch
 topic_slug: netkingdom
 state_hub_workstream_id: 7c9021b1-319c-4b4a-a8be-0642239a1893
 created: "2026-03-01"
-updated: "2026-03-01"
+updated: "2026-03-05"
 ---
 
 # Local Identity — Bootstrap User Store & Minimal OIDC
@@ -231,7 +231,7 @@ expiry and revocation functional.
 - [x] Filesystem permissions enforced on startup; `security-check` passes
 - [x] Audit log recording all auth events
 - [x] `docs/LocalIdentity.md` complete with import procedure and security model
-- [ ] NK-WP-0001 T07 migration procedure documented (Local Identity → Keycloak)
+- [x] NK-WP-0001 T07 migration procedure documented (Local Identity → Keycloak)
 
 ## Open Questions