Raise authentik postgres CPU, memory and buffer sizing

The 500m CPU limit is a 50ms CFS quota per 100ms period, so the pods
throttle on every burst even at idle and each query pays the latency.
128MB shared_buffers and a 256MB cache estimate also under-serve the
planner on the polymorphic joins authentik issues.

- raise resources to requests 500m/1Gi, limits 2/2Gi
- raise shared_buffers to 512MB and effective_cache_size to 1536MB
- keep the post-incident memory headroom multiple over shared_buffers

apps/base/authentik/cnpg_cluster.yaml

@@ -64,7 +64,7 @@ spec:
       archive_mode: "on"
       archive_timeout: 5min
       dynamic_shared_memory_type: posix
-      effective_cache_size: 256MB
+      effective_cache_size: 1536MB
       full_page_writes: "on"
       # Replicas report their oldest xmin to the primary, so multi-second reads on
       # a hot standby stop exhausting max_standby_streaming_delay and being
@@ -81,7 +81,7 @@ spec:
       max_parallel_workers: "16"
       max_replication_slots: "16"
       max_worker_processes: "16"
-      shared_buffers: 128MB
+      shared_buffers: 512MB
       shared_memory_type: mmap
       ssl_max_protocol_version: TLSv1.3
       ssl_min_protocol_version: TLSv1.3
@@ -109,13 +109,16 @@ spec:
     updateInterval: 30
   resources:
     limits:
-      cpu: 500m
+      # 500m is a 50ms CFS quota per 100ms period, exhausted by bursts even at
+      # ~0.01 cores average, so every query pays throttle latency.
+      cpu: "2"
       # 512Mi OOMKilled replicas under load (shared_buffers 128MB +
       # max_connections 200 leave no headroom) — see incident 2026-07-28.
-      memory: 1Gi
+      # shared_buffers 512MB needs the same headroom multiple, hence 2Gi.
+      memory: 2Gi
     requests:
-      cpu: 50m
-      memory: 512Mi
+      cpu: 500m
+      memory: 1Gi
   smartShutdownTimeout: 180
   startDelay: 3600
   stopDelay: 1800