arrstack: gate apps on DB via initContainer instead of sync-waves

Per review: drop the ArgoCD sync-wave annotations (their health-gating is
what deadlocked the first deploy) and instead add a wait-for-db init
container to each app that blocks until its own Postgres database+role is
reachable (libpq PG* env, password never in argv). ArgoCD applies
everything at once; the app container only starts once its DB is ready.

apps/base/arrstack/postgres/cnpg_backup.yaml

@@ -7,9 +7,6 @@ kind: ObjectStoreUser
 metadata:
   name: cnpg-arrstack-backup
   namespace: arrstack
-  annotations:
-    # S3 creds Secret must exist before the Cluster (wave -2) reconciles its backup.
-    argocd.argoproj.io/sync-wave: "-3"
 spec:
   displayName: "CNPG backup owner (arrstack)"
   uid: cnpg-arrstack-backup
@@ -22,8 +19,6 @@ kind: Bucket
 metadata:
   name: cnpg-arrstack
   namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "-3"
 spec:
   placementTarget: ec
   bucketName: cnpg-arrstack

apps/base/arrstack/postgres/cnpg_cluster.yaml

@@ -11,11 +11,6 @@ kind: Cluster
 metadata:
   name: arrstack-postgres
   namespace: arrstack
-  annotations:
-    # Wave 1: the per-app <app>-db Secrets (wave 0) must exist first — CNPG reads
-    # them as the managed roles' passwordSecret. ArgoCD gates dependents on the
-    # Cluster's health status.
-    argocd.argoproj.io/sync-wave: "-2"
 spec:
   inheritedMetadata:
     annotations:

apps/base/arrstack/postgres/database-prowlarr.yaml

@@ -7,8 +7,6 @@ kind: Database
 metadata:
   name: prowlarr-main
   namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "-1"
 spec:
   cluster:
     name: arrstack-postgres

apps/base/arrstack/postgres/database-radarr.yaml

@@ -7,8 +7,6 @@ kind: Database
 metadata:
   name: radarr-main
   namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "-1"
 spec:
   cluster:
     name: arrstack-postgres

apps/base/arrstack/postgres/database-sonarr.yaml

@@ -7,8 +7,6 @@ kind: Database
 metadata:
   name: sonarr-main
   namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "-1"
 spec:
   cluster:
     name: arrstack-postgres

apps/base/arrstack/postgres/vaultstaticsecret.yaml

@@ -13,8 +13,6 @@ kind: VaultStaticSecret
 metadata:
   name: sonarr-db
   namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "-3"
 spec:
   destination:
     create: true
@@ -32,8 +30,6 @@ kind: VaultStaticSecret
 metadata:
   name: radarr-db
   namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "-3"
 spec:
   destination:
     create: true
@@ -51,8 +47,6 @@ kind: VaultStaticSecret
 metadata:
   name: prowlarr-db
   namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "-3"
 spec:
   destination:
     create: true