cnpg: prepare for the operator upgrade to 1.30

Pin authentik-postgres to the image CNPG filled in at creation
(postgresql:17.4). Later operators default to PostgreSQL 18, and since
1.26 a higher major in the image triggers an offline in-place major
upgrade. immich-postgres already pins its pgvecto.rs image.

Turn on ENABLE_INSTANCE_MANAGER_INPLACE_UPDATES so the five operator hops
(1.25 -> 1.30, one minor at a time as the docs recommend) swap the
instance manager inside the running pods instead of restarting both
single-instance databases each time.

apps/templates/cloudnativepg-helm.yaml

@@ -13,7 +13,12 @@ spec:
     targetRevision: 0.23.2
     helm:
       values: |
-        # Default values are fine
+        config:
+          data:
+            # Swap the instance manager inside running pods on operator
+            # upgrades instead of restarting them. Both clusters have a
+            # single instance, so a restart means downtime.
+            ENABLE_INSTANCE_MANAGER_INPLACE_UPDATES: "true"
   destination:
     server: https://kubernetes.default.svc
     namespace: cnpg-system

authentik/postgresql-cluster.yaml

@@ -4,6 +4,9 @@ metadata:
   name: authentik-postgres
 spec:
   instances: 1
+  # Pinned so a new operator default (PostgreSQL 18 since CNPG 1.26.3) can't
+  # start an in-place major upgrade. CNPG filled this in at creation.
+  imageName: ghcr.io/cloudnative-pg/postgresql:17.4
   primaryUpdateStrategy: unsupervised
   bootstrap:
     initdb: