cnpg: prepare for the operator upgrade to 1.30

Pin authentik-postgres to the image CNPG filled in at creation
(postgresql:17.4). Later operators default to PostgreSQL 18, and since
1.26 a higher major in the image triggers an offline in-place major
upgrade. immich-postgres already pins its pgvecto.rs image.

Turn on ENABLE_INSTANCE_MANAGER_INPLACE_UPDATES so the five operator hops
(1.25 -> 1.30, one minor at a time as the docs recommend) swap the
instance manager inside the running pods instead of restarting both
single-instance databases each time.

authentik/postgresql-cluster.yaml

@@ -4,6 +4,9 @@ metadata:
   name: authentik-postgres
 spec:
   instances: 1
+  # Pinned so a new operator default (PostgreSQL 18 since CNPG 1.26.3) can't
+  # start an in-place major upgrade. CNPG filled this in at creation.
+  imageName: ghcr.io/cloudnative-pg/postgresql:17.4
   primaryUpdateStrategy: unsupervised
   bootstrap:
     initdb: