Add postgresql to appSpec and its Vault-backed credentials

One Vault path (secret/toolshed/postgres) into two namespaces: the server
needs the credential to initialise, api needs it to connect. Kept in one
file because it is one credential with two consumers — split, they drift,
and drift surfaces as an authentication error that looks nothing like a
config mistake.

The api-side Secret also carries a composed libpq URL, so host, port and
database name live in one place instead of across several environment
variables that can disagree.

Postgres gets its own namespace rather than living inside toolshed, so it
is addressed over cluster DNS like any other platform component and
outlives whatever consumes it.

values/incubator-infra-k8s-admin-prd-ase1-values.yaml

@@ -112,4 +112,23 @@ appSpec:
     nameOverride: harbor
     namespace: harbor
     chartDir: harbor
-    valuesDir: harbor
+    valuesDir: harbor
+  - name: postgresql
+    # Backs toolshed's control plane. Own namespace rather than living
+    # inside toolshed, so it is addressed over cluster DNS like any other
+    # platform component and outlives whatever consumes it:
+    #   postgresql.postgres.svc.cluster.local:5432
+    #
+    # nameOverride pinned for the same reason as everything else here —
+    # without it the rendered Application (and therefore the Helm release
+    # name, and therefore every object name) becomes
+    # "postgresql-admin-prd-prd".
+    #
+    # Hand-written chart, not Bitnami's: that registry has been actively
+    # unstable (infra issue #4) and PostgreSQL ships no official chart.
+    # Requires secretstores/toolshed-postgres-credentials.yaml to have
+    # synced first — the pod cannot start without the Secret.
+    nameOverride: postgresql
+    namespace: postgres
+    chartDir: postgresql
+    valuesDir: postgresql