Add Helm chart for the expense tracker (app, Postgres, ingress, backups)

- Deployment/Service for the app, StatefulSet/Service for Postgres 17
- Secrets (DB password, session secret, Google client, allowed e-mails) via
  ExternalSecret from OpenBao
- Ingress with a Let's Encrypt certificate, NetworkPolicy for Postgres
- Nightly pg_dump CronJob
- Optional OpenBao OIDC provider setup script

Co-Authored-By: Claude Sonnet 5 <[email protected]>

templates/networkpolicy.yaml

@@ -0,0 +1,28 @@
+{{- if .Values.networkPolicy.enabled }}
+# Postgres accepts connections only from the app and the backup job of this release.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: expense-tracker-postgres
+  namespace: {{ .Values.namespace.name }}
+  labels:
+    app.kubernetes.io/name: expense-tracker-postgres
+    {{- include "expense-tracker.labels" . | nindent 4 }}
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: expense-tracker-postgres
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: expense-tracker
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: expense-tracker-backup
+      ports:
+        - protocol: TCP
+          port: 5432
+{{- end }}