feat(s3): add cnpg Gitea database cluster + Makefile targets

- helm/gitea-db-cluster.yaml: cnpg Cluster for Gitea (1 instance, 10Gi, pg16)
  bootstraps gitea DB from gitea-db-credentials secret in databases namespace
- helm/gitea-db-secret.sops.yaml.template: credential secret template (encrypt before use)
- Makefile: add db-deploy, db-status, db-shell, db-logs targets; mark pg-deploy legacy
- .gitignore: allow *-cluster.yaml (k8s manifests with no secrets)

Cluster applied to live cluster. RAIL-HO-WP-0004-T03.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitignore

@@ -2,6 +2,8 @@
 helm/*.yaml
 !helm/*.sops.yaml
 !helm/*.yaml.template
+# Kubernetes manifests (no secrets) are safe to commit
+!helm/*-cluster.yaml
 
 # Kubeconfig
 *.kubeconfig