feat: expose template postgres to tailnet

[cooper (czxtm)]

Summary

• add a CNPG-managed read/write LoadBalancer Service backed by the existing Tailscale Kubernetes Operator
• publish the tailnet-only MagicDNS name template-db.tail6277a6.ts.net
• add the MagicDNS name to the CNPG server certificate SANs and admit only its managed proxy pods through the database NetworkPolicy

Security

No public hostname, Cloudflare TCP route, or NodePort is created. Tailscale ACLs remain the outer access control.

Validation

• YAML parsing and git diff --check passed

[linear-code]

ENG-1000