feat(db-bootstrap): reconcile service-DB sealed secrets via GitOps + seed script (#228)

[izzywdev]

Auto-opened — work completed by @claude on branch claude/issue-228-20260709-1748.

Closes #228

[github-actions]

terraform plan — terraform/contabo

Merging this PR applies exactly this saved plan (-out=tfplan). Review it as the apply approval.

Show plan

No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.

[github-actions]

CI Failure Analysis — test-infrastructure

Root cause: The test-infrastructure job runs on the staging ARC runner, which does not expose a Docker daemon. Every Docker command fails immediately:

```
docker info
failed to connect to the docker API at unix:///var/run/docker.sock;
dial unix /var/run/docker.sock: connect: no such file or directory
```

The Docker CLI binary is present (version 29.5.3 shown), but the daemon is not running — /var/run/docker.sock does not exist on the ARC runner pod. PR #227 fixed the EnricoMi Publish Test Results step (which also needed /var/run/docker.sock), but the core job remains broken because it requires Docker daemon to start containers.

The changes introduced by this PR (ArgoCD app YAML, seed script, Terraform, docs) are unrelated — this is a pre-existing CI infrastructure issue.

Fix needed — change one line in .github/workflows/infrastructure-tests.yml:

```diff
jobs:
test-infrastructure:

• runs-on: staging

• runs-on: ubuntu-latest
  ```

GitHub-hosted ubuntu-latest runners have the Docker daemon pre-configured. The workflow already accounts for this (the "Free up disk space" step strips Android/dotnet/GHC to reclaim RAM for containers).

Why I could not push the fix: This bot's GitHub App token lacks the workflows permission required to push changes to .github/workflows/ files. A human with write access (or a token with workflows scope) needs to apply the one-line change above and push to the PR branch.