Add Helm chart for the expense tracker (app, Postgres, ingress, backups)

- Deployment/Service for the app, StatefulSet/Service for Postgres 17
- Secrets (DB password, session secret, Google client, allowed e-mails) via
  ExternalSecret from OpenBao
- Ingress with a Let's Encrypt certificate, NetworkPolicy for Postgres
- Nightly pg_dump CronJob
- Optional OpenBao OIDC provider setup script

Co-Authored-By: Claude Sonnet 5 <[email protected]>

templates/_helpers.tpl

@@ -0,0 +1,21 @@
+{{- define "expense-tracker.labels" -}}
+app.kubernetes.io/part-of: expense-tracker
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/* Standard PG* connection variables; the libpq/pg client reads these directly. */}}
+{{- define "expense-tracker.pgenv" -}}
+- name: PGHOST
+  value: expense-tracker-postgres
+- name: PGPORT
+  value: "5432"
+- name: PGDATABASE
+  value: {{ .Values.postgres.database | quote }}
+- name: PGUSER
+  value: {{ .Values.postgres.user | quote }}
+- name: PGPASSWORD
+  valueFrom:
+    secretKeyRef:
+      name: expense-tracker-db
+      key: POSTGRES_PASSWORD
+{{- end }}