arrstack: use waitfordb initContainer instead of inline psql loop (#386)

## Why

The sonarr/radarr/prowlarr deployments gated app startup on their Postgres
database being reachable using a hand-written `psql`-in-a-shell loop running
the `postgres:17-alpine` image. Now that `unkin/waitfordb` is released
(v0.1.0), replace that inline probe with the purpose-built tool so the wait
logic lives in one tested place instead of being copy-pasted per workload.

`waitfordb` reads the same `PG*` env as a libpq fallback and exits `0` once
`SELECT 1` succeeds under those credentials/database, so the retrofit is a
drop-in — the password still never lands in argv.

## Changes

- Swap the `wait-for-db` initContainer image from `dockerhub/library/postgres:17-alpine`
  to `docker-internal/waitfordb:v0.1.0` (pinned, not `latest`) in all three
  arrstack deployments.
- Drop the `sh -c` psql loop `command` — `waitfordb` is the image entrypoint.
- Keep the existing `PGHOST/PGPORT/PGDATABASE/PGUSER/PGPASSWORD` env, the
  `wait-for-db` name, and the resource requests/limits unchanged.
- Add `WAITFORDB_TIMEOUT=5m` so a stuck database fails the pod fast, and
  `WAITFORDB_SSLMODE=disable` to match the in-cluster Postgres.

Validated with `kubectl kustomize apps/overlays/au-syd1/arrstack` (builds clean;
3 waitfordb refs, no remaining postgres init image).

Reviewed-on: #386
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

apps/base/arrstack/prowlarr/deployment.yaml

@@ -31,18 +31,14 @@ spec:
       initContainers:
         # Gate the app on its own Postgres database+role being reachable, instead
         # of relying on ArgoCD sync-waves (which deadlock if apps aren't Healthy).
-        # libpq reads PG* from env, so the password never lands in argv.
+        # waitfordb reads the PG* env as a libpq fallback, so the password never lands in argv.
         - name: wait-for-db
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/postgres:17-alpine
-          command:
-            - sh
-            - -c
-            - |
-              until psql -tAc 'select 1' >/dev/null 2>&1; do
-                echo "waiting for $PGDATABASE on $PGHOST..."; sleep 3
-              done
-              echo "database ready"
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/waitfordb:v0.1.0
           env:
+            - name: WAITFORDB_TIMEOUT
+              value: 5m
+            - name: WAITFORDB_SSLMODE
+              value: disable
             - name: PGHOST
               value: arrstack-postgres-rw.arrstack.svc.cluster.local
             - name: PGPORT

apps/base/arrstack/radarr/deployment.yaml

@@ -31,18 +31,14 @@ spec:
       initContainers:
         # Gate the app on its own Postgres database+role being reachable, instead
         # of relying on ArgoCD sync-waves (which deadlock if apps aren't Healthy).
-        # libpq reads PG* from env, so the password never lands in argv.
+        # waitfordb reads the PG* env as a libpq fallback, so the password never lands in argv.
         - name: wait-for-db
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/postgres:17-alpine
-          command:
-            - sh
-            - -c
-            - |
-              until psql -tAc 'select 1' >/dev/null 2>&1; do
-                echo "waiting for $PGDATABASE on $PGHOST..."; sleep 3
-              done
-              echo "database ready"
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/waitfordb:v0.1.0
           env:
+            - name: WAITFORDB_TIMEOUT
+              value: 5m
+            - name: WAITFORDB_SSLMODE
+              value: disable
             - name: PGHOST
               value: arrstack-postgres-rw.arrstack.svc.cluster.local
             - name: PGPORT

apps/base/arrstack/sonarr/deployment.yaml

@@ -31,18 +31,14 @@ spec:
       initContainers:
         # Gate the app on its own Postgres database+role being reachable, instead
         # of relying on ArgoCD sync-waves (which deadlock if apps aren't Healthy).
-        # libpq reads PG* from env, so the password never lands in argv.
+        # waitfordb reads the PG* env as a libpq fallback, so the password never lands in argv.
         - name: wait-for-db
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/postgres:17-alpine
-          command:
-            - sh
-            - -c
-            - |
-              until psql -tAc 'select 1' >/dev/null 2>&1; do
-                echo "waiting for $PGDATABASE on $PGHOST..."; sleep 3
-              done
-              echo "database ready"
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/waitfordb:v0.1.0
           env:
+            - name: WAITFORDB_TIMEOUT
+              value: 5m
+            - name: WAITFORDB_SSLMODE
+              value: disable
             - name: PGHOST
               value: arrstack-postgres-rw.arrstack.svc.cluster.local
             - name: PGPORT