Add port 61432 to ha-authentik-postgres for home's local CoreDNS rewrite

Found via live test: the CoreDNS rewrite for pg-authentik.ha.huskypup.net
resolves the NAME correctly to a local service, but DNS rewriting can't
change the PORT a client then connects to - the app tier is configured
with AUTHENTIK_POSTGRESQL__PORT=61432 (matching the external floating
hostname), so the local target needs to actually listen on 61432 too, or
the connection times out even though DNS resolves fine. Also repoints the
rewrite target from CNPG's own pg-authentik-rw to this Service, so it
resolves to a port that actually exists.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

infrastructure/authentik/manifests/ha-postgres-nodeport.yaml

@@ -6,6 +6,18 @@
 # object and won't fight with it. Needs
 # infrastructure/kyverno/policies/ha-failover-nodeport-exception.yaml
 # (disallow-nodeport-services is enforced cluster-wide otherwise).
+#
+# Second port (61432, ClusterIP only - no nodePort needed) added for the
+# CoreDNS rewrite in infrastructure/coredns/manifests/: home's own pods
+# resolving pg-authentik.ha.huskypup.net rewrite to THIS service (not
+# CNPG's own pg-authentik-rw) specifically so they can reach it on the
+# SAME port number the app tier is configured with (61432, matching the
+# external floating hostname's port - see infrastructure/authentik/
+# values.yaml's AUTHENTIK_POSTGRESQL__PORT) - CoreDNS rewrite only
+# changes the resolved NAME, not the port the client then connects to,
+# so the target service has to actually listen on that same port too, or
+# the connection times out even though DNS resolves correctly (confirmed
+# live 2026-08-20).
 apiVersion: v1
 kind: Service
 metadata:
@@ -17,6 +29,10 @@ spec:
     cnpg.io/cluster: pg-authentik
     cnpg.io/instanceRole: primary
   ports:
-    - port: 5432
+    - name: nodeport-5432
+      port: 5432
       targetPort: 5432
       nodePort: 32432
+    - name: floating-port-61432
+      port: 61432
+      targetPort: 5432