Phase 2: deploy n8n and Nextcloud warm standbys on the VPS

Same CNPG replica-cluster pattern as Authentik (continuous WAL replay
from home via VPS MinIO, app at 0 replicas until manual promotion - see
infrastructure/vps-standby/authentik/manifests/cnpg-cluster.yaml for the
full rationale).

n8n: N8N_ENCRYPTION_KEY copied byte-identical from home (kubectl, not
git) - decrypts stored credentials in the replicated DB, same reasoning
as Vault's unseal key / root token copies.

Nextcloud: adds infrastructure/vps-standby/nextcloud/manifests/
pvc-restore-cronjob.yaml, the read side of home's existing
nextcloud-pvc-sync restic backup - restores the latest snapshot from VPS
MinIO into this standby's PVC daily at 04:00 (2h after home's 02:00
backup). No Redis on the VPS side (no redis-operator deployed there,
out of scope for a standby that isn't serving traffic - Nextcloud
degrades gracefully to DB-based locking without it).

infrastructure/vps-standby/n8n/manifests/cnpg-cluster.yaml

@@ -0,0 +1,57 @@
+---
+# CNPG replica cluster continuously replaying WAL from home's pg-n8n
+# (apps/n8n/manifests/cnpg-cluster.yaml) via VPS MinIO's
+# cnpg-backups/pg-n8n bucket path. Same pattern as
+# infrastructure/vps-standby/authentik/manifests/cnpg-cluster.yaml - see
+# that file's comments for the full rationale (replica-cluster mode vs.
+# custom restore scripting, read-only until manual promotion).
+#
+# vps-minio-secret is a plain Secret copied here manually (kubectl, not
+# git), same as the authentik one:
+#   kubectl -n n8n create secret generic vps-minio-secret \
+#     --from-literal=accesskey=<vps minio root user> \
+#     --from-literal=secretkey=<vps minio root password>
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: pg-n8n
+  namespace: n8n
+spec:
+  imageName: ghcr.io/cloudnative-pg/postgresql:16
+  instances: 1
+
+  resources:
+    requests:
+      memory: "256Mi"
+      cpu: "25m"
+    limits:
+      memory: "1Gi"
+      cpu: "250m"
+
+  storage:
+    size: 10Gi
+    storageClass: local-path
+
+  bootstrap:
+    recovery:
+      source: home-backup
+
+  externalClusters:
+    - name: home-backup
+      barmanObjectStore:
+        destinationPath: s3://cnpg-backups/pg-n8n
+        endpointURL: http://vps-minio.minio.svc.cluster.local:9000
+        s3Credentials:
+          accessKeyId:
+            name: vps-minio-secret
+            key: accesskey
+          secretAccessKey:
+            name: vps-minio-secret
+            key: secretkey
+
+  replica:
+    enabled: true
+    source: home-backup
+
+  monitoring:
+    enablePodMonitor: false