netbox: add NetBox 4.6.8 with postgres, valkey and rqworker

Five components under applications/netbox: the web pod, an rqworker,
a daily housekeeping CronJob, postgres 18 and two valkey instances.
The task queue runs appendonly on its own PVC so queued jobs survive a
restart, while the cache instance is disposable.

Worker and cronjob override args rather than command, which replaces
CMD while keeping tini as the entrypoint, so only the web pod runs
migrations. Media, reports and scripts share one RWX PVC via subPaths
because both the web pod and the worker mount them.

Exposed on the internal gateway only.

applications/netbox/redis/statefulset.yaml

@@ -0,0 +1,46 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  namespace: netbox
+  name: netbox-redis
+spec:
+  replicas: 1
+  serviceName: netbox-redis
+  selector:
+    matchLabels:
+      app: netbox-redis
+  template:
+    metadata:
+      labels:
+        app: netbox-redis
+    spec:
+      restartPolicy: Always
+      containers:
+        - name: netbox-redis
+          image: valkey/valkey:9.1-alpine
+          # Task queue: appendonly so queued background jobs survive a restart.
+          command: ["sh", "-c", "exec valkey-server --appendonly yes --requirepass \"$REDIS_PASSWORD\""]
+          resources:
+            requests:
+              memory: "64Mi"
+              cpu: "50m"
+            limits:
+              memory: "256Mi"
+              cpu: "200m"
+          ports:
+            - containerPort: 6379
+          envFrom:
+            - secretRef:
+                name: netbox-redis-secrets
+          volumeMounts:
+            - name: netbox-redis-data
+              mountPath: /data
+          readinessProbe:
+            exec:
+              command: ["sh", "-c", "valkey-cli --pass \"$REDIS_PASSWORD\" ping | grep -q PONG"]
+            initialDelaySeconds: 5
+            periodSeconds: 10
+      volumes:
+        - name: netbox-redis-data
+          persistentVolumeClaim:
+            claimName: netbox-redis-pvc