Add a hand-written PostgreSQL chart for toolshed

Not Bitnami's: that registry has been actively unstable here (it broke
Contour twice, infra issue #4) and PostgreSQL publishes no official chart.
A single StatefulSet, PVC and Service is small enough that owning it costs
less than depending on an unstable repackage.

Credentials come from an existing Secret rather than being generated by
the chart — a chart that generates its own password regenerates it on
every render and silently locks you out of the existing volume.

Details that matter and are easy to get wrong:
  - PGDATA is a subdirectory of the mount, not the mount itself. initdb
    refuses to run in a directory that already has contents.
  - Probes run through a shell. Kubernetes does not expand $(VAR) inside
    exec probe commands, only in command/args.
  - fsGroup 70 so the volume stays writable after the entrypoint drops
    from root to the postgres user on the Alpine variant.
  - shared_buffers cut to 32MB from PostgreSQL's 128MB default. The node
    has 8GB and was at its ceiling before this.

Verified with helm template.

helm-templates/postgresql/templates/service.yaml

@@ -0,0 +1,23 @@
+{{- $name := .Values.fullnameOverride | default "postgresql" -}}
+# ClusterIP only. Nothing outside the cluster should reach the database, and
+# there is no Ingress here on purpose — Contour terminates HTTP, and exposing
+# PostgreSQL's wire protocol through it is neither possible nor wanted.
+#
+# Consumers address this as:
+#   {{ $name }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.port }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ $name }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: {{ $name }}
+spec:
+  type: ClusterIP
+  selector:
+    app: {{ $name }}
+  ports:
+    - name: postgres
+      port: {{ .Values.service.port }}
+      targetPort: postgres
+      protocol: TCP