Deploy real GitLab on the VPS (not just Gitea)

User wants actual GitLab on the VPS, not just Gitea's pull-mirror -
deliberate scope increase from the original plan's 'keep the VPS
lighter' design for git hosting specifically.

Simplified single-node equivalent of apps/gitlab (home) - same chart
version (7.7.0), same Authentik OIDC provider/client_id (added a second
redirect_uri to the shared GitLab provider in infrastructure/authentik/
gitlab-blueprint.yaml), same known chart bugs already diagnosed at home
(redis-init-fix.yaml for the initializer-ordering bug) - but:
  - 1 CNPG instance (local-path) instead of home's 3-instance HA
  - No Praefect - pointless HA routing with a single Gitaly node
  - No PgBouncer - direct CNPG connection, traffic is low enough
  - No SAML, no Container Registry, no KAS - addable later if needed
  - Own Traefik Ingress + https-redirect Middleware from the start
    (found needed the hard way on Vault/Gitea/n8n/Nextcloud/Authentik
    earlier this session - applying that lesson here immediately)

New Vault paths this needed: secret/vps/gitlab-redis (freshly generated,
this Redis instance is new, nothing to reuse) and widened the
vps-eso-reader policy to also allow secret/gitlab-oauth (the shared
Authentik client, already used by home's GitLab).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

infrastructure/vps-standby/gitlab/manifests/cnpg-cluster.yaml

@@ -0,0 +1,54 @@
+---
+# Real GitLab on the VPS - simplified single-node equivalent of
+# apps/gitlab/manifests/cnpg-cluster.yaml (home's is 3-instance HA with
+# Rook-Ceph; this is 1 instance on local-path, matching the "keep it
+# lighter" pattern already used for the rest of vps-standby).
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: pg-gitlab
+  namespace: gitlab
+spec:
+  imageName: ghcr.io/cloudnative-pg/postgresql:16
+  instances: 1
+
+  resources:
+    requests:
+      memory: "512Mi"
+      cpu: "50m"
+    limits:
+      memory: "2Gi"
+      cpu: "500m"
+
+  storage:
+    size: 20Gi
+    storageClass: local-path
+
+  primaryUpdateStrategy: unsupervised
+
+  bootstrap:
+    initdb:
+      database: gitlabhq_production
+      owner: app
+      postInitSQL:
+        - CREATE EXTENSION IF NOT EXISTS pg_trgm;
+        - CREATE EXTENSION IF NOT EXISTS btree_gist;
+
+  # Same tuning as home's, GitLab needs these regardless of scale
+  postgresql:
+    parameters:
+      max_connections: "200"
+      shared_buffers: "512MB"
+      effective_cache_size: "1536MB"
+      maintenance_work_mem: "128MB"
+      checkpoint_completion_target: "0.9"
+      wal_buffers: "16MB"
+      default_statistics_target: "100"
+      random_page_cost: "1.1"
+      effective_io_concurrency: "200"
+      work_mem: "8MB"
+      min_wal_size: "1GB"
+      max_wal_size: "4GB"
+
+  monitoring:
+    enablePodMonitor: false  # no Prometheus on the VPS cluster