Implement PostgreSQL production store path

Add the PostgreSQL backend, migration and stopped-write transfer tools, lease-aware deployment manifests, tenancy declarations, and shared conformance coverage. Persist grouping mutations in durable stores and separate process liveness from database readiness.

deploy/tenant-engine.yaml

@@ -10,18 +10,6 @@ metadata:
     # reach 5432 and the failure looks like DNS or a bad credential.
     railiance.io/postgres-client: platform-pg
 ---
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: tenant-engine-data
-  namespace: tenant-engine
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 1Gi
----
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -33,24 +21,27 @@ spec:
     matchLabels:
       app.kubernetes.io/name: tenant-engine
   strategy:
-    type: Recreate
+    type: RollingUpdate
   template:
     metadata:
       labels:
         app.kubernetes.io/name: tenant-engine
     spec:
       automountServiceAccountToken: false
+      serviceAccountName: tenant-engine
       containers:
       - name: tenant-engine
         env:
-        - name: TENANT_ENGINE_DATABASE_PATH
-          value: /data/tenant-engine.db
+        - name: TENANT_ENGINE_DATABASE_URL_FILE
+          value: /var/run/secrets/postgres-runtime/url
         - name: TENANT_ENGINE_FLEX_AUTH_URL
           value: http://flex-auth-tenant-engine.flex-auth.svc.cluster.local:8080
+        - name: TENANT_ENGINE_FLEX_AUTH_TOKEN_FILE
+          value: /var/run/secrets/flex-auth-caller/token
         image: forgejo.coulomb.social/coulomb/tenant-engine@sha256:44ca65f3cdd5967b0124e16b6aba10bf1ac2747e1dde96cbef3dd11ae7cc9574
         livenessProbe:
           httpGet:
-            path: /health
+            path: /live
             port: http
           periodSeconds: 20
         ports:
@@ -75,17 +66,33 @@ spec:
               - ALL
           readOnlyRootFilesystem: true
         volumeMounts:
-        - mountPath: /data
-          name: data
+        - mountPath: /var/run/secrets/postgres-runtime
+          name: postgres-runtime
+          readOnly: true
+        - mountPath: /var/run/secrets/flex-auth-caller
+          name: flex-auth-caller
+          readOnly: true
       securityContext:
         fsGroup: 10001
         runAsNonRoot: true
         seccompProfile:
           type: RuntimeDefault
       volumes:
-      - name: data
-        persistentVolumeClaim:
-          claimName: tenant-engine-data
+      - name: postgres-runtime
+        secret:
+          defaultMode: 0440
+          secretName: tenant-engine-postgres-runtime
+          items:
+          - key: url
+            path: url
+      - name: flex-auth-caller
+        projected:
+          defaultMode: 0440
+          sources:
+          - serviceAccountToken:
+              audience: flex-auth
+              expirationSeconds: 3600
+              path: token
 ---
 apiVersion: v1
 kind: Service
@@ -100,6 +107,13 @@ spec:
   selector:
     app.kubernetes.io/name: tenant-engine
 ---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: tenant-engine
+  namespace: tenant-engine
+automountServiceAccountToken: false
+---
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
@@ -124,6 +138,16 @@ spec:
     - port: 8090
       protocol: TCP
   egress:
+  - ports:
+    - port: 5432
+      protocol: TCP
+    to:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: databases
+      podSelector:
+        matchLabels:
+          cnpg.io/cluster: platform-pg
   - ports:
     - port: 8080
       protocol: TCP