cnpg: prepare for the operator upgrade to 1.30

Pin authentik-postgres to the image CNPG filled in at creation
(postgresql:17.4). Later operators default to PostgreSQL 18, and since
1.26 a higher major in the image triggers an offline in-place major
upgrade. immich-postgres already pins its pgvecto.rs image.

Turn on ENABLE_INSTANCE_MANAGER_INPLACE_UPDATES so the five operator hops
(1.25 -> 1.30, one minor at a time as the docs recommend) swap the
instance manager inside the running pods instead of restarting both
single-instance databases each time.

apps/templates/cloudnativepg-helm.yaml

@@ -13,7 +13,12 @@ spec:
     targetRevision: 0.23.2
     helm:
       values: |
-        # Default values are fine
+        config:
+          data:
+            # Swap the instance manager inside running pods on operator
+            # upgrades instead of restarting them. Both clusters have a
+            # single instance, so a restart means downtime.
+            ENABLE_INSTANCE_MANAGER_INPLACE_UPDATES: "true"
   destination:
     server: https://kubernetes.default.svc
     namespace: cnpg-system