feat: deploy n8n on the cluster

The runtime for the estate's autonomous agents. Postgres as a StatefulSet with
its own claim, n8n behind a cert-manager certificate and the nginx ingress, and
both secrets in Vault behind an AppRole scoped to n8n/* alone.

The certificate is issued into the cluster rather than copied into the repo, so
the private key never reaches git. The CA certificate is committed and mounted
as NODE_EXTRA_CA_CERTS, so a workflow can reach keycloak and the domain
gateways without anyone disabling verification to make it work.

One replica and strategy: Recreate, both deliberate — n8n needs Redis and queue
mode before a second scheduler is safe, and a ReadWriteOnce volume deadlocks a
rolling update.

N8N_ENCRYPTION_KEY is generated once and kept in Vault. Regenerating it does not
re-encrypt the stored credentials, it orphans them.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

k8s/n8n/configmap.yaml

@@ -0,0 +1,35 @@
+# Nothing here is sensitive. The two values that are — the database password and
+# the credential encryption key — arrive through n8n-secrets.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: n8n-config
+  namespace: n8n
+data:
+  GENERIC_TIMEZONE: Europe/Paris
+  TZ: Europe/Paris
+  NODE_ENV: production
+
+  # What n8n believes it is reachable at. It goes into the webhook URLs it
+  # generates and into the links it puts in its own UI, so it must be the
+  # ingress host and not the Service — a webhook advertised as `n8n` inside the
+  # cluster is a webhook nothing outside can call.
+  N8N_HOST: n8n.sttlab.local
+  N8N_PORT: "5678"
+  N8N_PROTOCOL: https
+  WEBHOOK_URL: https://n8n.sttlab.local/
+  N8N_EDITOR_BASE_URL: https://n8n.sttlab.local/
+
+  # TLS terminates at the ingress, so n8n itself serves plain HTTP and must be
+  # told it is behind a proxy — otherwise it reads the hop's address instead of
+  # the caller's.
+  N8N_PROXY_HOPS: "1"
+
+  # The default is to keep every execution for ever, which turns the database
+  # into a log. Two weeks is long enough to debug a failed run.
+  EXECUTIONS_DATA_PRUNE: "true"
+  EXECUTIONS_DATA_MAX_AGE: "336"
+
+  N8N_DIAGNOSTICS_ENABLED: "false"
+  N8N_VERSION_NOTIFICATIONS_ENABLED: "false"
+  N8N_RUNNERS_ENABLED: "true"