feat(infra): data, storage, devtools, and ory layer updates

- data: CNPG cluster tuning, OpenBao values, OpenSearch deployment fixes,
  OpenSearch PVC, barman vault secret for S3 backup credentials
- storage: SeaweedFS filer updates (s3.json via secret subPath), PVC for
  filer persistent storage
- devtools: Gitea values (SSH service, custom theme), gitea-theme-cm ConfigMap
- ory: add kratos-selfservice-urls.yaml for self-service flow URLs
- media: LiveKit values updated (TURN config, STUN, resource limits)
- vso: kustomization cleanup

base/data/postgres-cluster.yaml

@@ -16,8 +16,9 @@ spec:
     initdb:
       database: postgres
       owner: postgres
-      secret:
-        name: postgres-superuser
+      # No `secret` field — CNPG auto-generates a random superuser password
+      # and stores it in the `postgres-superuser` Secret. sunbeam seed reads
+      # that Secret to configure the OpenBao database secrets engine.
       postInitSQL:
         # Create all 10 logical databases and their owners.
         # Passwords are set by the seed-secrets script via ALTER USER after init.