arrstack: gate apps on DB via initContainer instead of sync-waves

Per review: drop the ArgoCD sync-wave annotations (their health-gating is
what deadlocked the first deploy) and instead add a wait-for-db init
container to each app that blocks until its own Postgres database+role is
reachable (libpq PG* env, password never in argv). ArgoCD applies
everything at once; the app container only starts once its DB is ready.

apps/base/arrstack/postgres/database-sonarr.yaml

@@ -7,8 +7,6 @@ kind: Database
 metadata:
   name: sonarr-main
   namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "-1"
 spec:
   cluster:
     name: arrstack-postgres