hindsight: Phase C manifests (multi-source app wave 8, external pgvector PG, ES from 1Password, chart-native ingress)

- application.yaml: single multi-source Application (openviking pattern),
  wave 8, chart v0.9.1 via path: + $values/values.yaml
- values.yaml: postgresql.enabled=false (external), existingSecret,
  LLM env (astro-orbiter:8001, Qwen3.8-27B-Q4_K_M), native ingress
  cosmic-rewind.local.mk-labs.cloud (api /health /v1 /mcp /ext, cp /)
- externalsecret.yaml: hindsight-credentials from 1Password mk-labs/hindsight
- namespace.yaml, postgres-pvc.yaml (10Gi nfs-emporium),
  deployment-postgres.yaml (ankane/pgvector pinned by digest),
  service-postgres.yaml (hindsight-postgres:5432)

cluster/applications/hindsight/deployment-postgres.yaml

@@ -0,0 +1,100 @@
+# ============================================================================
+# Deployment - Hindsight external PostgreSQL (ankane/pgvector)
+# Peter Parker, Phase C, t_6d47a360
+#
+# External-Postgres mode (plan pre-authorized fallback; Phase A proved the
+# chart's bundled postgresql is not secret-sourceable). The chart is pointed at
+# this instance via values.yaml: postgresql.enabled=false + external.host=
+# hindsight-postgres.
+#
+# IMAGE NOTE (deviation from task body): the task named `ankane/pgvector:15`,
+# but that tag does NOT exist — the upstream repo publishes only `latest` plus
+# `v0.1.3..v0.5.1` (verified against the docker.io registry API). `latest` is
+# postgres:17-bookworm + pgvector v0.8.6. We therefore pin `latest` BY DIGEST
+# (sha256:956744bd...) so the deploy is reproducible. This was empirically
+# validated on fastpass (pgvector 0.5.1 present, `CREATE EXTENSION vector`
+# succeeded, role has rlsuper). Flagged for Ryan in the Phase C report.
+#
+# POSTGRES_PASSWORD comes from the ExternalSecret (hindsight-credentials,
+# key `postgres-password`) — the same value the chart interpolates into
+# HINDSIGHT_API_DATABASE_URL, so the server login and the API DSN agree.
+# ============================================================================
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: hindsight-postgres
+  namespace: hindsight
+  labels:
+    app.kubernetes.io/name: hindsight
+    app.kubernetes.io/component: database
+    app.kubernetes.io/part-of: platform-buildout
+spec:
+  replicas: 1
+  strategy:
+    # Recreate: RWO PVC + single writer. No rolling overlap (no two pods on one volume).
+    type: Recreate
+  selector:
+    matchLabels:
+      app: hindsight-postgres
+  template:
+    metadata:
+      labels:
+        app: hindsight-postgres
+        app.kubernetes.io/name: hindsight
+        app.kubernetes.io/component: database
+    spec:
+      containers:
+        - name: postgres
+          image: docker.io/ankane/pgvector@sha256:956744bd14e9cbdf639c61c2a2a7c7c2c48a9c8cdd42f7de4ac034f4e96b90f8
+          # Digest-pinned (immutable) => IfNotPresent avoids redundant re-pulls.
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: postgres
+              containerPort: 5432
+              protocol: TCP
+          env:
+            - name: POSTGRES_USER
+              value: hindsight
+            - name: POSTGRES_DB
+              value: hindsight
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: hindsight-credentials
+                  key: postgres-password
+          volumeMounts:
+            - name: postgres-data
+              # Stock postgres data path (ankane/pgvector is postgres:17-based,
+              # no PGDATA override needed — unlike firecrawl's custom layout).
+              mountPath: /var/lib/postgresql/data
+          resources:
+            requests:
+              cpu: 500m
+              memory: 1Gi
+            limits:
+              cpu: "1"
+              memory: 2Gi
+          livenessProbe:
+            exec:
+              command:
+                - pg_isready
+                - -U
+                - hindsight
+            initialDelaySeconds: 30
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            exec:
+              command:
+                - pg_isready
+                - -U
+                - hindsight
+            initialDelaySeconds: 5
+            periodSeconds: 5
+            timeoutSeconds: 3
+            failureThreshold: 3
+      volumes:
+        - name: postgres-data
+          persistentVolumeClaim:
+            claimName: hindsight-postgres-data