Finish RPF-WP-0018; RPF-WP-0019 repository-complete

RPF-WP-0018 closed: all seven tasks done. The provider-declaration finding
was adopted upstream and its canonical form is the provider: block in
tenancy.yaml; adaptive-pricing declined the standing co-signature and
supplied typed tier minima instead, recorded in ADR-0002. Three corrections
against our own output are recorded in the documents rather than edited
away.

RPF-WP-0019 T03 done (ceiling of three, memory binding, apps-pg-2 named as
overflow, enforced by make apps-pg-verify-capacity). T01/T02 are
repository-complete: backup target, retention, per-consumer connection
limits, role timeouts and Burstable resources are declared in source and
published in s3-consumer-interfaces 1.1.0 before rollout. They stay in
progress because no live application, backup success or restore proof
exists, and declared configuration is not a section 13 artifact. T04 waits
on that window.

apps-pg R reason corrected to say the target is declared-not-applied rather
than absent.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

helm/apps-pg-cluster.yaml

@@ -26,6 +26,13 @@ metadata:
 spec:
   instances: 1   # bump to 3 when node RAM > 8GB
   imageName: ghcr.io/cloudnative-pg/postgresql:16
+  resources:
+    requests:
+      cpu: 100m
+      memory: 256Mi
+    limits:
+      cpu: "1"
+      memory: 1Gi
   storage:
     size: 10Gi
   bootstrap:
@@ -43,14 +50,41 @@ spec:
       - name: vergabe                    # RAILIANCE-WP-0002 T04 (vergabe-teilnahme)
         ensure: present
         login: true
+        connectionLimit: 20
         passwordSecret:
           name: vergabe-app-credentials
       - name: coulomb_social             # CSOC-WP-0002 (coulomb-social)
-
         ensure: present
         login: true
+        connectionLimit: 20
         passwordSecret:
           name: coulomb-social-app-credentials
+  postgresql:
+    parameters:
+      max_connections: "100"
+      log_connections: "on"
+      log_disconnections: "on"
+      log_lock_waits: "on"
+      log_min_duration_statement: "1000"
+      track_io_timing: "on"
+  backup:
+    retentionPolicy: "30d"
+    barmanObjectStore:
+      destinationPath: s3://railiance-platform-pg-backup/apps-pg/
+      endpointURL: https://s3.nl-ams.scw.cloud
+      s3Credentials:
+        accessKeyId:
+          name: platform-pg-backup-s3
+          key: ACCESS_KEY_ID
+        secretAccessKey:
+          name: platform-pg-backup-s3
+          key: ACCESS_SECRET_KEY
+      wal:
+        compression: gzip
+        maxParallel: 2
+      data:
+        compression: gzip
+        jobs: 2
   # HA replica + connection pooler are deferred (RAILIANCE-WP-0003 Notes):
   #   services:
   #     additional: