Replace DNS-flip failover watcher with static vps.huskypup.net subdomains

The DNS-flip watcher (scripts/vps-dns-failover/) was designed but never
actually installed on the VPS despite being tracked as done - real gap,
found when asked whether the standby services are actually reachable.

New design: instead of dynamically flipping *.kube.huskypup.net between
home and VPS IPs, give the VPS site its own permanent, always-resolving
subdomain - vault/gitea/auth/n8n/nextcloud.vps.huskypup.net, each with
real Ingress+TLS on the VPS's own Traefik+cert-manager (both already
installed by Phase 0 bootstrap, just never wired up). No token-scoping
decision needed since there's no dynamic flipping - reuses the same
cert-manager token pattern as home.

Also scales Authentik/n8n/Nextcloud from 0 to 1 replica on the VPS so
the replicated data is actually browsable at all times, not just
present-but-unreachable. Their CNPG clusters are still read-only
replicas (spec.replica.enabled: true) - writes will error until a
deliberate manual promotion, but reads/browsing work now. Vault and
Gitea were already running continuously.

infrastructure/vps-standby/n8n/manifests/ingress.yaml

@@ -0,0 +1,27 @@
+---
+# See infrastructure/vps-standby/vault/manifests/ingress.yaml for the
+# vps.huskypup.net subdomain design rationale.
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: vps-n8n
+  namespace: n8n
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-production
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - n8n.vps.huskypup.net
+      secretName: vps-n8n-tls
+  rules:
+    - host: n8n.vps.huskypup.net
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: vps-n8n
+                port:
+                  number: 80

infrastructure/vps-standby/n8n/values.yaml

@@ -1,8 +1,11 @@
 # n8n warm standby on the VPS - Phase 2. Same discipline as
 # infrastructure/vps-standby/authentik/values.yaml: the CNPG replica
-# cluster keeps the DB continuously warm in the background, but the app
-# itself stays at replicaCount: 0 until a deliberate manual promotion
-# (flip pg-n8n's spec.replica.enabled to false, then scale this up).
+# cluster keeps the DB continuously warm in the background, and the app
+# runs continuously too (replicaCount: 1, reachable at
+# n8n.vps.huskypup.net - see manifests/ingress.yaml) - workflow
+# saves/executions will error against the read-only DB until a
+# deliberate manual promotion (flip pg-n8n's spec.replica.enabled to
+# false), but the UI and existing workflow definitions are browsable.
 #
 # N8N_ENCRYPTION_KEY must be byte-identical to home's - it decrypts
 # stored credentials (API keys, OAuth tokens, etc.) that live encrypted
@@ -28,7 +31,7 @@ config:
   generic:
     timezone: America/New_York
   path: /
-  host: n8n.kube.huskypup.net
+  host: n8n.vps.huskypup.net
   port: 5678
   protocol: https
   executions:
@@ -41,8 +44,7 @@ config:
 
 secret: {}
 
-# Not run in normal operation - see file header.
-replicaCount: 0
+replicaCount: 1
 
 service:
   type: ClusterIP
@@ -85,8 +87,8 @@ extraEnvSecrets:
     key: encryption-key
 
 extraEnv:
-  WEBHOOK_URL: https://n8n.kube.huskypup.net/
-  N8N_EDITOR_BASE_URL: https://n8n.kube.huskypup.net
+  WEBHOOK_URL: https://n8n.vps.huskypup.net/
+  N8N_EDITOR_BASE_URL: https://n8n.vps.huskypup.net
   N8N_LOG_LEVEL: error
 
 postgresql: