Support an external PostgreSQL (bundled postgresql cannot be disabled, host is hardcoded)

Summary

We want to deploy DevGuard on EKS via Argo CD and point it at a PostgreSQL we already operate. The chart currently makes this impossible without forking it: the bundled postgresql StatefulSet always renders, and the database host is hardcoded to the in-release Service name postgresql in every consumer.

Chart version: 1.13.2 (main @ 0f0c3e7).

What blocks it today

1. No way to disable the bundled PostgreSQL.
None of the templates under templates/postgresql/ is gated on a value postgresql-statefulset.yaml, postgresql-persistentvolumeclaim.yaml, postgresql-service.yaml, postgresql-configmap.yaml, postgresql-initdb.yaml always render.
https://github.com/l3montree-dev/devguard-helm-chart/tree/0f0c3e7ac27fabc9ba1ffad72aafb41f57161358/templates/postgresql

2. Database host/port are hardcoded, not values.

• API (init container, migrate, and main container):
  https://github.com/l3montree-dev/devguard-helm-chart/blob/0f0c3e7ac27fabc9ba1ffad72aafb41f57161358/templates/devguard/deployment.yaml#L82-L85
  https://github.com/l3montree-dev/devguard-helm-chart/blob/0f0c3e7ac27fabc9ba1ffad72aafb41f57161358/templates/devguard/deployment.yaml#L119-L122
  https://github.com/l3montree-dev/devguard-helm-chart/blob/0f0c3e7ac27fabc9ba1ffad72aafb41f57161358/templates/devguard/deployment.yaml#L156-L161

  - name: POSTGRES_HOST
    value: postgresql
  - name: POSTGRES_PORT
    value: "5432"
  

• Kratos migrate + main container:
  https://github.com/l3montree-dev/devguard-helm-chart/blob/0f0c3e7ac27fabc9ba1ffad72aafb41f57161358/templates/kratos/kratos-deployment.yaml#L43-L44
  https://github.com/l3montree-dev/devguard-helm-chart/blob/0f0c3e7ac27fabc9ba1ffad72aafb41f57161358/templates/kratos/kratos-deployment.yaml#L105-L106
• Kratos cleanup CronJob:
  https://github.com/l3montree-dev/devguard-helm-chart/blob/0f0c3e7ac27fabc9ba1ffad72aafb41f57161358/templates/kratos/kratos-cleanup-cronjob.yaml#L43-L44

  - name: DSN
    value: postgres://kratos:$(DB_PASSWORD)@postgresql:5432/kratos?sslmode=disable
  

The usual workaround an ExternalName Service named postgresql is not available because the chart itself owns a Service with that name (templates/postgresql/postgresql-service.yaml).

3. Extension / bootstrap requirements are only documented by the init script.
postgresql-initdb.yaml creates the semver extension (pg_semver, not in the stock postgres image), the kratos database and the kratos role:
https://github.com/l3montree-dev/devguard-helm-chart/blob/0f0c3e7ac27fabc9ba1ffad72aafb41f57161358/templates/postgresql/postgresql-initdb.yaml#L8-L18
An operator bringing their own database needs this list spelled out somewhere (README / values comment), and ideally the API should fail with a clear message when the extension is missing.

Proposal

Add to postgresql in the schema (values.yaml is generated from schema/schema.ts):

postgresql:
  # Deploy the bundled PostgreSQL StatefulSet. Set to false to use an external database.
  enabled: true
  # Used by api, kratos and the kratos cleanup job when enabled=false
  external:
    host: ""
    port: 5432
    sslMode: disable

Then:

• gate every template under templates/postgresql/ (and the postgresql ServiceMonitor / Grafana dashboard / NetworkPolicy devguard-postgresql-ingress) on .Values.postgresql.enabled;
• resolve host/port through a helper (devguard.postgresHost / devguard.postgresPort) that returns postgresql / 5432 when enabled=true and external.host / external.port otherwise, and use it in the API POSTGRES_HOST/POSTGRES_PORT envs and both kratos DSNs;
• keep the existing secret contract (db-secret postgres-password, kratos-db-secret password) so useExistingSecret / useExistingKratosDatabaseSecret continue to work for external databases;
• document the external-database prerequisites: CREATE EXTENSION semver on the devguard database, a kratos database owned by a kratos role, sslmode expectations.

Context

• Platform: EKS, Argo CD (so the useExisting*Secret toggles are already in use), external PostgreSQL 16 shared by other workloads with its own backup/monitoring.