feat: Add CloudNativePG with B2 backups for persistent Rancher database

- Add Local Path Provisioner for storage
- Add CloudNativePG operator (v1.27.0) via Flux
- Create PostgreSQL cluster with B2 (Backblaze) auto-backup/restore
- Update Rancher to use external PostgreSQL via CATTLE_DB_CATTLE_* env vars
- Add weekly pg_dump CronJob to B2 (Sundays 2AM)
- Add pre-destroy backup hook to destroy workflow
- Add B2 credentials to Doppler (B2_ACCOUNT_ID, B2_APPLICATION_KEY)
- Generate RANCHER_DB_PASSWORD in Doppler

Backup location: HetznerTerra/rancher-backups/
Retention: 14 backups

infrastructure/addons/cnpg/kustomization.yaml

@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository-cnpg.yaml
+  - helmrelease-cnpg.yaml
+  - namespace.yaml
+  - b2-credentials-externalsecret.yaml
+  - rancher-db-password-externalsecret.yaml
+  - postgres-cluster.yaml
+  - cnpg-cluster-rw-svc.yaml
+  - pgdump-cronjob.yaml