pelican: migrate to envFrom with per-container InfisicalSecrets

Folds the pelican-config ConfigMap into Infisical so the container has a single envFrom. Pins imagePullPolicy to IfNotPresent because ghcr.io/pelican-dev/panel no longer allows anonymous pulls.

applications/pelican/postgres/infisicalsecret.yaml

@@ -0,0 +1,25 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: pelican-postgres-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    kubernetesAuth:
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/pelican/postgres"
+        # Non-recursive: keys are already named as the container expects.
+        recursive: false
+  managedSecretReference:
+    secretName: pelican-postgres-secrets
+    secretNamespace: pelican
+    secretType: Opaque

applications/pelican/postgres/persistentvolumeclaim.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: pelican-postgres-pvc
+  namespace: pelican
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 5Gi

applications/pelican/postgres/service.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: pelican-postgres
+  namespace: pelican
+spec:
+  selector:
+    app: pelican-postgres
+  ports:
+    - port: 5432
+      targetPort: 5432

applications/pelican/postgres/statefulset.yaml

@@ -0,0 +1,40 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: pelican-postgres
+  namespace: pelican
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: pelican-postgres
+  serviceName: pelican-postgres
+  template:
+    metadata:
+      labels:
+        app: pelican-postgres
+    spec:
+      restartPolicy: Always
+      terminationGracePeriodSeconds: 60
+      containers:
+        - name: postgres
+          image: postgres:17-alpine
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
+          ports:
+            - containerPort: 5432
+          volumeMounts:
+            - name: pelican-postgres-data
+              mountPath: /var/lib/postgresql/data
+          envFrom:
+            - secretRef:
+                name: pelican-postgres-secrets
+      volumes:
+        - name: pelican-postgres-data
+          persistentVolumeClaim:
+            claimName: pelican-postgres-pvc