feat(gitea-db): add NetworkPolicy for app-namespace ingress; update SCOPE

- Add allow-ingress-from-default-gitea-db NetworkPolicy so Gitea pods
  in default namespace can connect to gitea-db cnpg cluster on 5432
- Update SCOPE.md to reflect cnpg as the canonical DB operator (postgresql-ha
  subchart fully decommissioned as of this session)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

helm/gitea-db-networkpolicies.yaml

@@ -1,6 +1,7 @@
 # NetworkPolicies for gitea-db cnpg cluster
 # The databases namespace has a default-deny-all policy; each cluster needs
-# explicit egress-to-kube-api and ingress-from-cnpg-operator policies.
+# explicit egress-to-kube-api, ingress-from-cnpg-operator, and
+# ingress-from-app-namespace policies.
 ---
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
@@ -41,3 +42,23 @@ spec:
           protocol: TCP
         - port: 9187
           protocol: TCP
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-ingress-from-default-gitea-db
+  namespace: databases
+spec:
+  podSelector:
+    matchLabels:
+      cnpg.io/cluster: gitea-db
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: default
+      ports:
+        - port: 5432
+          protocol: TCP