arrstack: use waitfordb initContainer instead of inline psql loop

The sonarr/radarr/prowlarr deployments gated startup on Postgres with a
hand-written psql-in-a-shell loop running the postgres:17-alpine image.
Replace it with the purpose-built waitfordb image (v0.1.0), which reads the
same PG* env as a libpq fallback and exits 0 once SELECT 1 succeeds.

- swap image to docker-internal/waitfordb:v0.1.0 (pinned), drop the sh/psql
  command (waitfordb is the entrypoint)
- keep the existing PGHOST/PGPORT/PGDATABASE/PGUSER/PGPASSWORD env, name,
  and resources unchanged
- add WAITFORDB_TIMEOUT=5m so a stuck DB fails the pod fast, and
  WAITFORDB_SSLMODE=disable to match the in-cluster Postgres

apps/base/arrstack/prowlarr/deployment.yaml

@@ -31,18 +31,14 @@ spec:
       initContainers:
         # Gate the app on its own Postgres database+role being reachable, instead
         # of relying on ArgoCD sync-waves (which deadlock if apps aren't Healthy).
-        # libpq reads PG* from env, so the password never lands in argv.
+        # waitfordb reads the PG* env as a libpq fallback, so the password never lands in argv.
         - name: wait-for-db
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/postgres:17-alpine
-          command:
-            - sh
-            - -c
-            - |
-              until psql -tAc 'select 1' >/dev/null 2>&1; do
-                echo "waiting for $PGDATABASE on $PGHOST..."; sleep 3
-              done
-              echo "database ready"
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/waitfordb:v0.1.0
           env:
+            - name: WAITFORDB_TIMEOUT
+              value: 5m
+            - name: WAITFORDB_SSLMODE
+              value: disable
             - name: PGHOST
               value: arrstack-postgres-rw.arrstack.svc.cluster.local
             - name: PGPORT

apps/base/arrstack/radarr/deployment.yaml

@@ -31,18 +31,14 @@ spec:
       initContainers:
         # Gate the app on its own Postgres database+role being reachable, instead
         # of relying on ArgoCD sync-waves (which deadlock if apps aren't Healthy).
-        # libpq reads PG* from env, so the password never lands in argv.
+        # waitfordb reads the PG* env as a libpq fallback, so the password never lands in argv.
         - name: wait-for-db
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/postgres:17-alpine
-          command:
-            - sh
-            - -c
-            - |
-              until psql -tAc 'select 1' >/dev/null 2>&1; do
-                echo "waiting for $PGDATABASE on $PGHOST..."; sleep 3
-              done
-              echo "database ready"
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/waitfordb:v0.1.0
           env:
+            - name: WAITFORDB_TIMEOUT
+              value: 5m
+            - name: WAITFORDB_SSLMODE
+              value: disable
             - name: PGHOST
               value: arrstack-postgres-rw.arrstack.svc.cluster.local
             - name: PGPORT

apps/base/arrstack/sonarr/deployment.yaml

@@ -31,18 +31,14 @@ spec:
       initContainers:
         # Gate the app on its own Postgres database+role being reachable, instead
         # of relying on ArgoCD sync-waves (which deadlock if apps aren't Healthy).
-        # libpq reads PG* from env, so the password never lands in argv.
+        # waitfordb reads the PG* env as a libpq fallback, so the password never lands in argv.
         - name: wait-for-db
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/postgres:17-alpine
-          command:
-            - sh
-            - -c
-            - |
-              until psql -tAc 'select 1' >/dev/null 2>&1; do
-                echo "waiting for $PGDATABASE on $PGHOST..."; sleep 3
-              done
-              echo "database ready"
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/waitfordb:v0.1.0
           env:
+            - name: WAITFORDB_TIMEOUT
+              value: 5m
+            - name: WAITFORDB_SSLMODE
+              value: disable
             - name: PGHOST
               value: arrstack-postgres-rw.arrstack.svc.cluster.local
             - name: PGPORT