hindsight: Phase C manifests (multi-source app wave 8, external pgvector PG, ES from 1Password, chart-native ingress)

- application.yaml: single multi-source Application (openviking pattern),
  wave 8, chart v0.9.1 via path: + $values/values.yaml
- values.yaml: postgresql.enabled=false (external), existingSecret,
  LLM env (astro-orbiter:8001, Qwen3.8-27B-Q4_K_M), native ingress
  cosmic-rewind.local.mk-labs.cloud (api /health /v1 /mcp /ext, cp /)
- externalsecret.yaml: hindsight-credentials from 1Password mk-labs/hindsight
- namespace.yaml, postgres-pvc.yaml (10Gi nfs-emporium),
  deployment-postgres.yaml (ankane/pgvector pinned by digest),
  service-postgres.yaml (hindsight-postgres:5432)

cluster/applications/hindsight/application.yaml

@@ -0,0 +1,66 @@
+# ============================================================================
+# ArgoCD Application: Hindsight (agent-memory service, Phase C)
+# Wave: 8 (per approved Phase C plan; after Harbor at Wave 7)
+# Deployment method: GitOps (Gitea -> ArgoCD)
+# ============================================================================
+#
+# Multi-source: upstream Helm chart (pinned v0.9.1) + local values +
+# manifests from repo. Follows the openviking pattern exactly
+# (chart via path:, $values override, dir source ref: values).
+#
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: hindsight
+  namespace: argocd
+  labels:
+    app.kubernetes.io/name: hindsight
+    app.kubernetes.io/part-of: mk-labs
+  annotations:
+    # Wave 8 (apps-of-apps view): Hindsight Application syncs after Harbor (Wave 7).
+    # This annotation controls the Application's position in the apps-of-apps rollout,
+    # NOT the ordering of resources within the Application. Internal resource ordering
+    # is controlled by sync-wave annotations on individual resources (ExternalSecret = -1).
+    argocd.argoproj.io/sync-wave: "8"
+    description: |
+      Hindsight agent-memory service (Phase C).
+      Upstream chart pinned v0.9.1 (api + control-plane).
+      External Postgres (ankane/pgvector) + secrets from 1Password mk-labs.
+      LLM: Qwen3.8-27B-Q4_K_M at astro-orbiter:8001 (openai-compatible).
+      Ingress: cosmic-rewind.local.mk-labs.cloud (api /health /v1 /mcp /ext + control-plane UI).
+spec:
+  project: default
+
+  sources:
+    # Source 1: Helm chart from upstream vectorize-io/hindsight (pinned v0.9.1)
+    - repoURL: https://github.com/vectorize-io/hindsight.git
+      targetRevision: v0.9.1
+      path: helm/hindsight
+      helm:
+        valueFiles:
+          # Local values override upstream defaults
+          - $values/cluster/applications/hindsight/values.yaml
+
+    # Source 2: Gitea homelab repo — values + ExternalSecret + namespace + postgres + ingress
+    - repoURL: https://gitea.mk-labs.cloud/rblundon/homelab.git
+      targetRevision: main
+      path: cluster/applications/hindsight
+      ref: values
+      directory:
+        # Exclude the Application manifest itself (already in argocd)
+        exclude: "application.yaml"
+
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: hindsight
+
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true
+      # Important: do not prune ExternalSecrets on ArgoCD uninstall
+      # (credentials live in 1Password, re-sync on pod restart)
+      - PrunePropagationPolicy=background