Land RPF-WP-0039 third apps-pg consumer source.

Admit vergabe_demo_company as the third declared consumer, track
the bounded provisioner and scoped controls, and refresh admission
occupancy to 3/3. Overflow remains apps-pg-2 before any fourth.

Assistant: grok
Assistant-Session: 01a0a23b-3bf0-7341-b4e5-9dc05f72573a

helm/apps-pg-cluster.yaml

@@ -59,6 +59,16 @@ spec:
         connectionLimit: 20
         passwordSecret:
           name: coulomb-social-app-credentials
+      - name: vergabe_demo_company
+        ensure: present
+        login: true
+        inherit: false
+        superuser: false
+        createdb: false
+        createrole: false
+        connectionLimit: 20
+        passwordSecret:
+          name: vergabe-demo-company-credentials
   postgresql:
     parameters:
       max_connections: "100"

helm/apps-pg-consumer-controls.sql

@@ -1,6 +1,8 @@
 -- Idempotent controls not expressible in the installed CNPG managed.roles CRD.
 -- Apply as the controlled apps-pg cluster administrator only after notifying
--- both consumers of the published limits in docs/s3-consumer-interfaces.md.
+-- bound consumers of the published limits in docs/s3-consumer-interfaces.md.
+-- The third consumer is scoped separately in helm/vergabe-demo-company-controls.sql;
+-- do not reuse this historical file to onboard it.
 ALTER ROLE vergabe SET statement_timeout = '15s';
 ALTER ROLE vergabe SET idle_in_transaction_session_timeout = '15s';
 ALTER ROLE coulomb_social SET statement_timeout = '15s';

helm/apps-pg-databases.yaml

@@ -36,3 +36,20 @@ spec:
   name: coulomb_social_db
   owner: coulomb_social
   ensure: present
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: vergabe-demo-company-db            # RPF-WP-0039
+  namespace: databases
+  labels:
+    app.kubernetes.io/name: apps-pg
+    app.kubernetes.io/component: database-instance
+    railiance.io/layer: s3-platform
+    railiance.io/consumer: vergabe-demo-company
+spec:
+  cluster:
+    name: apps-pg
+  name: vergabe_demo_company
+  owner: vergabe_demo_company
+  ensure: present

helm/vergabe-demo-company-controls.sql

@@ -0,0 +1,5 @@
+-- Only the fresh invited demo consumer. Never touches historical vergabe_db.
+ALTER ROLE vergabe_demo_company SET statement_timeout = '15s';
+ALTER ROLE vergabe_demo_company SET idle_in_transaction_session_timeout = '15s';
+REVOKE CONNECT, TEMPORARY ON DATABASE vergabe_demo_company FROM PUBLIC;
+GRANT CONNECT, TEMPORARY ON DATABASE vergabe_demo_company TO vergabe_demo_company;

helm/vergabe-demo-company-database.yaml

@@ -0,0 +1,10 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: vergabe-demo-company-db
+  namespace: databases
+spec:
+  cluster:
+    name: apps-pg
+  name: vergabe_demo_company
+  owner: vergabe_demo_company

helm/vergabe-demo-company-role.yaml

@@ -0,0 +1,11 @@
+# Exact managed.roles entry; append through the bounded owner helper.
+name: vergabe_demo_company
+ensure: present
+login: true
+inherit: false
+superuser: false
+createdb: false
+createrole: false
+connectionLimit: 20
+passwordSecret:
+  name: vergabe-demo-company-credentials