deploy encapi to au-syd1

encapi is the new Postgres-backed Puppet ENC replacing Cobbler. Stand it up in
k8s alongside artifactapi so the puppet masters (via encapi-cli classify) and
the enc_direct_facts fact can reach it at encapi.k8s.syd1.au.unkin.net.

- add apps/base/encapi: namespace, deployment (git.unkin.net/unkin/encapi), service,
  gateway + httproute (encapi.k8s.syd1.au.unkin.net), configmap, CNPG cluster +
  pooler (db encapi), VaultAuth + VaultStaticSecrets (postgres-credentials, environment)
- add apps/overlays/au-syd1/encapi overlay
- register apps/overlays/*/encapi in the platform ApplicationSet

Note: the Vault KV secrets kv/kubernetes/namespace/encapi/default/{postgres-credentials,
environment} must be seeded before first sync; 'environment' carries DBPASS (matching
the CNPG owner password) and ENCAPI_WRITE_TOKEN.

apps/base/encapi/deployment.yaml

@@ -0,0 +1,64 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: encapi
+  namespace: encapi
+  annotations:
+    reloader.stakater.com/auto: "true"
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: encapi
+  strategy:
+    rollingUpdate:
+      maxUnavailable: 1
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: encapi
+    spec:
+      automountServiceAccountToken: true
+      containers:
+        - name: encapi
+          image: git.unkin.net/unkin/encapi:v0.0.1
+          imagePullPolicy: IfNotPresent
+          ports:
+            - containerPort: 8000
+              name: http
+              protocol: TCP
+          envFrom:
+            # DBHOST/DBNAME/DBPORT/DBUSER/DBSSL/LISTEN_ADDR
+            - configMapRef:
+                name: encapi-env
+                optional: false
+            # DBPASS + ENCAPI_WRITE_TOKEN (seeded in Vault, see cutover notes)
+            - secretRef:
+                name: environment
+                optional: false
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            initialDelaySeconds: 15
+            periodSeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 5
+            timeoutSeconds: 5
+            failureThreshold: 3
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi
+      restartPolicy: Always