POSTGRES_PASSWORD now references umami-secrets-infisical. Adds strategy: Recreate (single-replica RWO PVC — avoids two postmasters racing PGDATA during a roll), permanent. Data dir already initialized, so the byte-identical POSTGRES_PASSWORD is never re-applied on restart (benign). umami still on old umami-secrets (both live in parallel = zero gap). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>