Fix CNPG distributed-topology validation errors

Confirmed live against the vcluster.cnpg.io admission webhook: (1)
replica.enabled is mutually exclusive with primary/self - they're two
different mechanisms (old single-source replica-cluster mode vs the
newer distributed-topology model), not composable. (2) Both replica.self
and replica.primary must reference names present in THAT cluster's own
externalClusters list - including a self-referencing entry, even though
it describes the cluster itself. Renamed VPS's 'home-backup' external
cluster to 'home' throughout (bootstrap.recovery.source too) so one name
consistently satisfies barmanObjectStore, connectionParameters, and the
primary reference; added matching self-referencing entries on both
sides.

infrastructure/authentik/manifests/cnpg-cluster.yaml

@@ -99,7 +99,31 @@ spec:
   # route (same path used for MinIO/CrowdSec backups all session) - no
   # UniFi port-forward needed for this direction, only the reverse
   # (VPS/witness reaching INTO home) needed that.
+  # CNPG's distributed-topology validation requires both replica.self and
+  # replica.primary to reference names present in THIS cluster's OWN
+  # externalClusters list - including a self-referencing entry (confirmed
+  # live: "External cluster home not found" until one was added, even
+  # though "home" is this very cluster). The "home" entry's
+  # connectionParameters point at its own local -rw service - never
+  # actually dialed while primary: home (that's this cluster), it only
+  # exists to satisfy the name-reference validation.
   externalClusters:
+    - name: home
+      connectionParameters:
+        host: pg-authentik-rw
+        port: "5432"
+        dbname: app
+        user: streaming_replica
+        sslmode: verify-ca
+      sslCert:
+        name: pg-authentik-replication
+        key: tls.crt
+      sslKey:
+        name: pg-authentik-replication
+        key: tls.key
+      sslRootCert:
+        name: pg-authentik-ca
+        key: ca.crt
     - name: vps
       connectionParameters:
         host: 100.108.113.41
@@ -120,9 +144,11 @@ spec:
   # Distributed topology: both sides agree home is primary today. Failover
   # flips the VPS's replica.primary to "vps" (+ promotion token) - see the
   # plan doc's failover-watcher section. Failback is the same in reverse,
-  # deliberately manual.
+  # deliberately manual. No replica.enabled here - that flag belongs to
+  # CNPG's older single-source replica-cluster mode and is mutually
+  # exclusive with primary/self (confirmed live: "replica mode enabled is
+  # not compatible with the primary field").
   replica:
     self: home
     primary: home
-    source: vps  # where home would replicate FROM if it were ever a replica (not active now - primary: home)