hindsight: Phase C manifests (multi-source app wave 8, external pgvector PG, ES from 1Password, chart-native ingress)

- application.yaml: single multi-source Application (openviking pattern),
  wave 8, chart v0.9.1 via path: + $values/values.yaml
- values.yaml: postgresql.enabled=false (external), existingSecret,
  LLM env (astro-orbiter:8001, Qwen3.8-27B-Q4_K_M), native ingress
  cosmic-rewind.local.mk-labs.cloud (api /health /v1 /mcp /ext, cp /)
- externalsecret.yaml: hindsight-credentials from 1Password mk-labs/hindsight
- namespace.yaml, postgres-pvc.yaml (10Gi nfs-emporium),
  deployment-postgres.yaml (ankane/pgvector pinned by digest),
  service-postgres.yaml (hindsight-postgres:5432)

cluster/applications/hindsight/service-postgres.yaml

@@ -0,0 +1,27 @@
+---
+# ============================================================================
+# Service - Hindsight external PostgreSQL
+# Peter Parker, Phase C, t_6d47a360
+#
+# ClusterIP service named `hindsight-postgres` — this is the host the chart's
+# external Postgres config points at (values.yaml: postgresql.external.host).
+# The Hindsight API reaches it at hindsight-postgres:5432 within the namespace.
+# ============================================================================
+apiVersion: v1
+kind: Service
+metadata:
+  name: hindsight-postgres
+  namespace: hindsight
+  labels:
+    app.kubernetes.io/name: hindsight
+    app.kubernetes.io/component: database
+    app.kubernetes.io/part-of: platform-buildout
+spec:
+  type: ClusterIP
+  selector:
+    app: hindsight-postgres
+  ports:
+    - name: postgres
+      port: 5432
+      targetPort: 5432
+      protocol: TCP