Initial cluster config: NixOS flake + k3s + 5 node definitions

- Multi-host flake.nix (3x N97 x86_64 + 2x RPi4 aarch64)
- Shared modules: k3s-cluster, tailscale, meos-gateway
- Node configs: n97-1 (control plane), n97-2/n97-3 (Ollama workers), rpi4-1/rpi4-2 (ARM workers)
- K8s manifests: Forgejo, Postgres (CNPG), Umami, OpenBrain, MeOS Dashboard, MCP servers
- Bootstrap and DB migration scripts
- Migration plan doc (7-day phased rollout)

apps/postgres/cluster.yaml

@@ -0,0 +1,59 @@
+# CloudNative PG operator (recommended for Postgres on K8s)
+# https://cloudnative-pg.io/
+#
+# Install: kubectl apply --server-side -f https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/release-1.25/releases/cnpg-1.25.1.yaml
+#
+# Then create the cluster below.
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: postgres-scobleclaw
+  namespace: database
+spec:
+  instances: 1
+  imageName: ghcr.io/cloudnative-pg/postgresql:17.4
+
+  storage:
+    size: 5Gi
+    storageClass: local-path
+
+  resources:
+    requests:
+      memory: "256Mi"
+      cpu: "100m"
+    limits:
+      memory: "512Mi"
+      cpu: "500m"
+
+  postgresql:
+    parameters:
+      max_connections: "200"
+      shared_buffers: "128MB"
+
+  databases:
+    - name: forgejo
+      owner: forgejo
+    - name: umami
+      owner: umami
+
+  users:
+    - name: forgejo
+      password: "<set-via-secret>"
+    - name: umami
+      password: "<set-via-secret>"
+
+  enableSuperuserAccess: false
+
+  monitoring:
+    enablePodMonitor: false
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: postgres-users
+  namespace: database
+type: Opaque
+stringData:
+  forgejo-password: "<change-me>"
+  umami-password: "<change-me>"