feat(helm): support Secret-backed db URL for Postgres

[TaylorMutch]

Summary

Add a Secret-backed OPENSHELL_DB_URL path to the Helm chart so operators can point the gateway at Postgres without putting the password in values.yaml or Helm release history.

Related Issue

N/A

Changes

• values.yaml: new server.dbUrlSecretRef (name + key); empty name preserves the existing SQLite default.
• templates/statefulset.yaml: when dbUrlSecretRef.name is set, drop the --db-url CLI flag and inject OPENSHELL_DB_URL via secretKeyRef.
• ci/values-postgres.yaml: new overlay documenting the out-of-band Secret recipe and the helm upgrade -f command.
• README.md: list the new overlay alongside cert-manager / Keycloak.

Testing

• `mise run pre-commit` passes
• `helm template` with defaults still emits `--db-url "sqlite:/var/openshell/openshell.db"` and no DB env var.
• `helm template -f values.yaml -f ci/values-postgres.yaml` drops `--db-url` and emits an `OPENSHELL_DB_URL` env entry sourced from `openshell-db`.
• End-to-end Postgres install against a real cluster (not yet run).

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (not applicable — chart-only change)

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.