umami: repoint postgres to Infisical secret + flip to Recreate (3b-i)

POSTGRES_PASSWORD now references umami-secrets-infisical. Adds strategy:
Recreate (single-replica RWO PVC — avoids two postmasters racing PGDATA
during a roll), permanent. Data dir already initialized, so the
byte-identical POSTGRES_PASSWORD is never re-applied on restart (benign).
umami still on old umami-secrets (both live in parallel = zero gap).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

umami/deployment.yaml

@@ -30,6 +30,10 @@ metadata:
     app: postgres
 spec:
   replicas: 1
+  # Single-replica Postgres on a RWO local-path PVC: Recreate avoids two postmasters
+  # briefly racing the same PGDATA during a roll (RollingUpdate surges a 2nd pod first).
+  strategy:
+    type: Recreate
   selector:
     matchLabels:
       app: postgres
@@ -50,7 +54,7 @@ spec:
             - name: POSTGRES_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: umami-secrets
+                  name: umami-secrets-infisical
                   key: postgres-password
           volumeMounts:
             - name: postgres-data