Add a CNPG-managed PostgreSQL database to a workload

Add a postgresql.cnpg.io/v1 Cluster resource to an existing directory under applications/ or components/, register it in kustomization.yaml, validate the build, and print the env-from-secret snippet the workload needs to consume the auto-generated <cluster>-app credentials Secret.

The skill bakes in conventions learned the hard way in this repo. Do not strip these defaults without a stated reason — each one was added to fix a real alert or sync issue: