refactor: make this a reusable deployment, not ours

Every environment value is a ${VAR} for the caller to substitute: hostname,
images, storage, ingress class, TLS issuer, Vault server and path, timezone,
retention. Nothing in k8s/ names a host, a realm, an agent or an estate.

Removed: the Flux plumbing under dev/, which described one deployment, and the
ExternalSecret pulling a specific agent's Keycloak client secret. Both belong to
whoever deploys this. The lab CA ConfigMap goes with them — the mount stays,
parameterised and marked optional, because 'trust a private CA' is a property of
an environment and not of n8n.

The README is now the template's: how to consume it, what every variable means,
and the three things it deliberately does not do.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

k8s/postgres/statefulset.yaml

@@ -6,7 +6,7 @@ apiVersion: apps/v1
 kind: StatefulSet
 metadata:
   name: n8n-postgres
-  namespace: n8n
+  namespace: ${NAMESPACE}
 spec:
   serviceName: n8n-postgres
   replicas: 1
@@ -22,7 +22,7 @@ spec:
         fsGroup: 999
       containers:
         - name: postgres
-          image: postgres:16.10-alpine
+          image: ${POSTGRES_IMAGE}
           ports:
             - name: postgres
               containerPort: 5432
@@ -68,4 +68,4 @@ spec:
         accessModes: ["ReadWriteOnce"]
         resources:
           requests:
-            storage: 5Gi
+            storage: ${POSTGRES_STORAGE}