feat: Add CloudNativePG with B2 backups for persistent Rancher database

- Add Local Path Provisioner for storage
- Add CloudNativePG operator (v1.27.0) via Flux
- Create PostgreSQL cluster with B2 (Backblaze) auto-backup/restore
- Update Rancher to use external PostgreSQL via CATTLE_DB_CATTLE_* env vars
- Add weekly pg_dump CronJob to B2 (Sundays 2AM)
- Add pre-destroy backup hook to destroy workflow
- Add B2 credentials to Doppler (B2_ACCOUNT_ID, B2_APPLICATION_KEY)
- Generate RANCHER_DB_PASSWORD in Doppler

Backup location: HetznerTerra/rancher-backups/
Retention: 14 backups

infrastructure/addons/rancher/helmrelease-rancher.yaml

@@ -26,6 +26,19 @@ spec:
     tls: external
     replicas: 1
     extraEnv:
+      - name: CATTLE_DB_CATTLE_HOST
+        value: cnpg-cluster-rw.cnpg-cluster.svc
+      - name: CATTLE_DB_CATTLE_PORT
+        value: "5432"
+      - name: CATTLE_DB_CATTLE_DATABASE
+        value: postgres
+      - name: CATTLE_DB_CATTLE_USERNAME
+        value: postgres
+      - name: CATTLE_DB_CATTLE_PASSWORD
+        valueFrom:
+          secretKeyRef:
+            name: rancher-db-password
+            key: password
       - name: CATTLE_PROMETHEUS_METRICS
         value: "true"
     resources: