Wire CNPG streaming replication + distributed topology for pg-authentik pilot

Adds connectionParameters (real streaming, not just barmanObjectStore
WAL-archive polling) to both sides' existing externalClusters entry, plus
replica.self/primary fields declaring the distributed topology (both
currently agree home is primary). Auth reuses CNPG's own auto-generated
streaming_replica client certs, cross-copied between clusters manually
(kubectl, not git - same pattern as every other cross-cluster secret
tonight) since they're the exact credential each side's pg_hba.conf
already trusts.

Also adds the VPS-side NodePort exposing its own pg-authentik primary
back to home (home->VPS already works via the existing netbird-egress
route, no UniFi port-forward needed for that direction - only the
reverse, VPS/witness reaching into home, needed the WAN workaround).

infrastructure/authentik/manifests/cnpg-cluster.yaml

@@ -76,3 +76,53 @@ spec:
   monitoring:
     enablePodMonitor: true
 
+  # Multi-site active failover pilot (see
+  # /home/scooby/.claude/plans/jiggly-snacking-iverson.md) - streaming
+  # replication to/from the VPS's pg-authentik cluster, alongside (not
+  # replacing) the barmanObjectStore backup above.
+  #
+  # Auth: reuses CNPG's own generated streaming_replica client cert
+  # (CN=streaming_replica, issued by the VPS's own pg-authentik CA) -
+  # copied here manually as pg-authentik-vps-{ca,replication} (kubectl,
+  # not git - same pattern as every other cross-cluster secret tonight).
+  # This is the exact credential CNPG's own pg_hba.conf already trusts
+  # for streaming replication, nothing new to provision.
+  #
+  # sslmode: verify-ca (not verify-full) - the VPS's server cert was
+  # issued for its in-cluster DNS names, not for the NodePort IP address
+  # (100.108.113.41) home actually dials; verify-ca still validates the
+  # cert chain/CA trust and encrypts the connection, just skips hostname
+  # matching.
+  #
+  # Reachable via 100.108.113.41 (VPS's Netbird IP) - home reaching OUT
+  # to the VPS already works today via the netbird-egress DaemonSet's
+  # route (same path used for MinIO/CrowdSec backups all session) - no
+  # UniFi port-forward needed for this direction, only the reverse
+  # (VPS/witness reaching INTO home) needed that.
+  externalClusters:
+    - name: vps
+      connectionParameters:
+        host: 100.108.113.41
+        port: "32433"
+        dbname: app
+        user: streaming_replica
+        sslmode: verify-ca
+      sslCert:
+        name: pg-authentik-vps-replication
+        key: tls.crt
+      sslKey:
+        name: pg-authentik-vps-replication
+        key: tls.key
+      sslRootCert:
+        name: pg-authentik-vps-ca
+        key: ca.crt
+
+  # Distributed topology: both sides agree home is primary today. Failover
+  # flips the VPS's replica.primary to "vps" (+ promotion token) - see the
+  # plan doc's failover-watcher section. Failback is the same in reverse,
+  # deliberately manual.
+  replica:
+    self: home
+    primary: home
+    source: vps  # where home would replicate FROM if it were ever a replica (not active now - primary: home)
+