authentik: raise CNPG postgres memory to stop replica OOMKills (#300)

Authentik's intermittent API 500s (which failed two terraform-authentik CI runs today) were traced to its CNPG postgres replicas being OOMKilled: 512Mi limits leave no headroom over shared_buffers 128MB + max_connections 200, both OOM events matched the 500 bursts to the second, and the session-pinned RO pooler turns each replica death into a batch of severed read connections. The primary is at 84% of its limit and is next.

- raise the authentik CNPG memory limit from 512Mi to 1Gi and request from 256Mi to 512Mi

Follow-up candidates (not in this PR): RO pooler poolMode session→transaction to shrink the blast radius of a replica loss; revisit max_connections/shared_buffers sizing.

Reviewed-on: #300
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>

apps/base/authentik/cnpg_cluster.yaml

@@ -106,10 +106,12 @@ spec:
   resources:
     limits:
       cpu: 500m
-      memory: 512Mi
+      # 512Mi OOMKilled replicas under load (shared_buffers 128MB +
+      # max_connections 200 leave no headroom) — see incident 2026-07-28.
+      memory: 1Gi
     requests:
       cpu: 50m
-      memory: 256Mi
+      memory: 512Mi
   smartShutdownTimeout: 180
   startDelay: 3600
   stopDelay: 1800