authentik: repoint postgres sts POSTGRES_PASSWORD to authentik-secrets-infisical

Postgres-first cutover step. Already-initialized PG17 ignores POSTGRES_PASSWORD
on restart (role pw in pg_authid), so this byte-identical roll is benign.
StatefulSet RollingUpdate is ordered terminate-then-create (no two-postmaster
surge), so no Recreate flip. Applied via kubectl (not ArgoCD-managed).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

authentik/statefulset-postgresql.yaml

@@ -29,7 +29,7 @@ spec:
           valueFrom:
             secretKeyRef:
               key: POSTGRES_PASSWORD
-              name: authentik-secrets
+              name: authentik-secrets-infisical
         - name: PGDATA
           value: /var/lib/postgresql/data
         image: postgres:17-alpine