WP-0011: deploy scaffolding for revenue.coulomb.social

Record T01 package (in-repo k8s/railiance, combined /ui + API app,
dedicated CNPG). Add Dockerfile, healthz, migration/bootstrap scripts,
kustomize manifests, ArgoCD Application (in railiance-platform), and
docs/deployment.md. T05 left open for operator DNS/OpenBao/image push.

k8s/railiance/cnpg-cluster.yaml

@@ -0,0 +1,36 @@
+# Dedicated CNPG Cluster for Target Revenue Trust Service pilot data (WP-0011).
+# Co-located in the target-revenue workload namespace so one ArgoCD Application
+# can own the full stack (issue-core pattern + database).
+#
+# Pre-req secrets in namespace target-revenue (OpenBao ExternalSecret or
+# operator-seeded): target-revenue-pg-credentials, target-revenue-trf-app-credentials.
+# See docs/deployment.md.
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: target-revenue-pg
+  namespace: target-revenue
+  labels:
+    app.kubernetes.io/name: target-revenue-pg
+    app.kubernetes.io/part-of: target-revenue
+    app.kubernetes.io/component: database
+  annotations:
+    argocd.argoproj.io/sync-wave: "-2"
+spec:
+  instances: 1
+  imageName: ghcr.io/cloudnative-pg/postgresql:16
+  storage:
+    size: 5Gi
+  bootstrap:
+    initdb:
+      database: target_revenue
+      owner: trf_owner
+      secret:
+        name: target-revenue-pg-credentials
+  managed:
+    roles:
+      - name: trf_app
+        ensure: present
+        login: true
+        passwordSecret:
+          name: target-revenue-trf-app-credentials