Phase 2: deploy n8n and Nextcloud warm standbys on the VPS

Same CNPG replica-cluster pattern as Authentik (continuous WAL replay
from home via VPS MinIO, app at 0 replicas until manual promotion - see
infrastructure/vps-standby/authentik/manifests/cnpg-cluster.yaml for the
full rationale).

n8n: N8N_ENCRYPTION_KEY copied byte-identical from home (kubectl, not
git) - decrypts stored credentials in the replicated DB, same reasoning
as Vault's unseal key / root token copies.

Nextcloud: adds infrastructure/vps-standby/nextcloud/manifests/
pvc-restore-cronjob.yaml, the read side of home's existing
nextcloud-pvc-sync restic backup - restores the latest snapshot from VPS
MinIO into this standby's PVC daily at 04:00 (2h after home's 02:00
backup). No Redis on the VPS side (no redis-operator deployed there,
out of scope for a standby that isn't serving traffic - Nextcloud
degrades gracefully to DB-based locking without it).

infrastructure/vps-standby/n8n/values.yaml

@@ -0,0 +1,105 @@
+# n8n warm standby on the VPS - Phase 2. Same discipline as
+# infrastructure/vps-standby/authentik/values.yaml: the CNPG replica
+# cluster keeps the DB continuously warm in the background, but the app
+# itself stays at replicaCount: 0 until a deliberate manual promotion
+# (flip pg-n8n's spec.replica.enabled to false, then scale this up).
+#
+# N8N_ENCRYPTION_KEY must be byte-identical to home's - it decrypts
+# stored credentials (API keys, OAuth tokens, etc.) that live encrypted
+# in the DB being replicated. Unlike Authentik's chart-deterministic
+# secret_key, n8n's isn't derived from anything reproducible - it's
+# copied for real (kubectl, not git, same as Vault's unseal key /
+# root token):
+#   kubectl -n n8n create secret generic n8n-config-secret \
+#     --from-literal=encryption-key=<home's N8N_ENCRYPTION_KEY>
+image:
+  repository: n8nio/n8n
+  tag: "2.0.3"
+
+config:
+  database:
+    type: postgresdb
+    postgresdb:
+      host: pg-n8n-rw
+      port: 5432
+      database: n8n
+      user: n8n
+      schema: public
+  generic:
+    timezone: America/New_York
+  path: /
+  host: n8n.kube.huskypup.net
+  port: 5678
+  protocol: https
+  executions:
+    mode: regular
+    saveDataOnError: all
+    saveDataOnSuccess: all
+    saveDataManualExecutions: true
+    pruneData: true
+    pruneDataMaxAge: 3760
+
+secret: {}
+
+# Not run in normal operation - see file header.
+replicaCount: 0
+
+service:
+  type: ClusterIP
+  port: 80
+
+securityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - ALL
+  seccompProfile:
+    type: RuntimeDefault
+
+ingress:
+  enabled: false
+
+persistence:
+  enabled: true
+  type: existing
+  existingClaim: n8n-main-persistence
+  storageClass: local-path
+  accessModes:
+    - ReadWriteOnce
+  size: 10Gi
+
+resources:
+  requests:
+    cpu: 50m
+    memory: 256Mi
+  limits:
+    cpu: "500m"
+    memory: 512Mi
+
+extraEnvSecrets:
+  DB_POSTGRESDB_PASSWORD:
+    name: pg-n8n-app
+    key: password
+  N8N_ENCRYPTION_KEY:
+    name: n8n-config-secret
+    key: encryption-key
+
+extraEnv:
+  WEBHOOK_URL: https://n8n.kube.huskypup.net/
+  N8N_EDITOR_BASE_URL: https://n8n.kube.huskypup.net
+  N8N_LOG_LEVEL: error
+
+postgresql:
+  enabled: false
+
+redis:
+  enabled: false
+
+scaling:
+  enabled: false
+
+extraVolumes: []
+extraVolumeMounts: []
+nodeSelector: {}
+tolerations: []
+affinity: {}