Upgrade Postgres before 15.x EOL (2027-11-11)

PostgreSQL 15 reaches end-of-life on **2027-11-11**. After that date no more security or bug-fix releases.

Currently on \`postgres:15.18\` (\`cluster-manifests/db/postgres/deployment.yaml\`).

## Plan
- Major upgrade to 16 or 17 (whichever is current LTS-equivalent at upgrade time).
- This is a real migration — needs \`pg_upgrade\` or a dump/restore, not a tag bump.
- Use the per-app role separation already in place to do it cleanly (each DB can be migrated/verified independently before cutover).

## Deadline
Be on 16+ before 2027-11-11. Reminder: aim to do this no later than 2027-09 so there's runway if something breaks.

Refs:
- https://www.postgresql.org/support/versioning/