Replace DNS-flip failover watcher with static vps.huskypup.net subdomains

The DNS-flip watcher (scripts/vps-dns-failover/) was designed but never
actually installed on the VPS despite being tracked as done - real gap,
found when asked whether the standby services are actually reachable.

New design: instead of dynamically flipping *.kube.huskypup.net between
home and VPS IPs, give the VPS site its own permanent, always-resolving
subdomain - vault/gitea/auth/n8n/nextcloud.vps.huskypup.net, each with
real Ingress+TLS on the VPS's own Traefik+cert-manager (both already
installed by Phase 0 bootstrap, just never wired up). No token-scoping
decision needed since there's no dynamic flipping - reuses the same
cert-manager token pattern as home.

Also scales Authentik/n8n/Nextcloud from 0 to 1 replica on the VPS so
the replicated data is actually browsable at all times, not just
present-but-unreachable. Their CNPG clusters are still read-only
replicas (spec.replica.enabled: true) - writes will error until a
deliberate manual promotion, but reads/browsing work now. Vault and
Gitea were already running continuously.

infrastructure/vps-standby/authentik/values.yaml

@@ -1,11 +1,11 @@
 # Authentik warm standby on the VPS - Phase 2. The CNPG replica cluster
 # (manifests/cnpg-cluster.yaml) continuously replays WAL from home in the
-# background; the app itself is NOT run in normal operation (replicas: 0)
-# since the replica DB is read-only until a deliberate manual promotion -
-# an Authentik pod trying to write against a read-only DB would just
-# crashloop uselessly. Promotion runbook: flip the CNPG cluster's
-# spec.replica.enabled to false (see cnpg-cluster.yaml), then scale
-# server/worker up from 0.
+# background. The app itself DOES run continuously (replicas: 1, reachable
+# at auth.vps.huskypup.net - see manifests/ingress.yaml) so the replicated
+# data is browsable/verifiable at all times, even though the underlying DB
+# is a read-only CNPG replica - writes (new logins, session creation) will
+# error until a deliberate manual promotion. Promotion runbook: flip the
+# CNPG cluster's spec.replica.enabled to false (see cnpg-cluster.yaml).
 #
 # The `authentik:` block below (secret_key/postgresql "env://" indirection)
 # is copied VERBATIM from infrastructure/authentik/values.yaml on purpose -
@@ -34,7 +34,7 @@ global:
       prefix: AUTHENTIK_POSTGRESQL__
   env:
     - name: AUTHENTIK_URL
-      value: "https://auth.kube.huskypup.net"
+      value: "https://auth.vps.huskypup.net"
     - name: AUTHENTIK_POSTGRESQL__HOST
       valueFrom:
         secretKeyRef:
@@ -59,7 +59,7 @@ global:
       value: "5432"
 
 server:
-  replicas: 0
+  replicas: 1
   containerSecurityContext:
     runAsNonRoot: true
     allowPrivilegeEscalation: false
@@ -78,7 +78,7 @@ server:
     enabled: false
 
 worker:
-  replicas: 0
+  replicas: 1
   containerSecurityContext:
     runAsNonRoot: true
     allowPrivilegeEscalation: false