fix(cnpg): Wire explicit region to barman-cloud ObjectStore

Garage rejects HeadBucket calls with 400 Bad Request when boto3 sends
them without a signed region, which makes CNPG's bootstrap.recovery
fail at the barman-cloud-check-wal-archive step. Add REGION=garage to
the barman-cloud-creds Secret and reference it from the ObjectStore's
s3Credentials.region so barman-cloud-* invocations sign with the
correct region.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

kubernetes/apps/authentik-db/barman-creds.sops.yaml

@@ -7,6 +7,7 @@ type: Opaque
 stringData:
     ACCESS_KEY_ID: ENC[AES256_GCM,data:SjcYDpvy5SVXK/4/EGzIb5UjEqZTZ5sYB0E=,iv:mFfBZmdEi+Yj4HqMhZZ7NSS1dHwniYZKocJYElw00uw=,tag:4scsORHe7NAgbbg2fA2kNA==,type:str]
     ACCESS_SECRET_KEY: ENC[AES256_GCM,data:095NGZvte1IA7E1dOmOxq9zzRbIXr3gR7c5ousfoo4+LH7kmu+Ea8HM89FaJ/HuPnM5R79D7kHi8d8HY1KPeuA==,iv:vN+Y2Ei6RflaXz04knl9kF4HYv0sN7DyUafgbO7lFd0=,tag:+VvivaaVxEubcyczED1yrw==,type:str]
+    REGION: ENC[AES256_GCM,data:RZXJfMo4,iv:ZQ68sunCV3103rjoYN2YhPBUNb2knJSFy10y73hv8po=,tag:SBK4KFoZEYSkGkbkIHwapA==,type:str]
 sops:
     age:
         - recipient: age1yqjvqkwwwxdj7mr546zfs5ckzuwndp69ya2n2drd4vypwns8w4ys04qfy3
@@ -18,7 +19,7 @@ sops:
             TW1aNW9kbWlCd1E0Mk5TL2VUdXhNc3MK7dx8WmafY6o6AArqkadsW8FpTTmjIMkd
             ztPsFiFl0bHbgrpK6F2o0vDKd0RHhMkDGf8iFlpAAcmMJJBAjhw35A==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-04-20T13:25:00Z"
-    mac: ENC[AES256_GCM,data:i6qGXbSlaWRZ9zYFZeKORvdGmfxXBMJuQ3+6/Lp5REEn0XXMfIqZLyvJryipOtgkyOrnId9HjeR9Fh0QeVxO95tbQPcKAMbYWsj49uhQ23VaLyt6CUIc9HOKLqF2EFp+OHVNNJTx5tm4Us4nIPcKlP3lV5rO1tlnFOypNNvbuKE=,iv:iG3WaCvqqWSdTkPghGgcfl6ZcJtJoY7u2pYUbFR+iA8=,tag:JYaOBE+6+MZCoHNdE0kLEg==,type:str]
+    lastmodified: "2026-04-20T21:02:22Z"
+    mac: ENC[AES256_GCM,data:28S0BF/0Ixap+H6rV0FIWGVBfgqqJWNbmsDXi6a9g1CiNLK4tOdW/ACeohLqJrkWQKGZzPEwCtbl3FCk6z+t8s9ZwBjeGmh5E8eQnjfss+AEZTeLE1Xij9lI8kL0S+RXV3uMLiFU/ks3BmFziZBErj/MUyXnDNhw0n1VpRODcC4=,iv:1shlhwzkkF4E1JVQpLBzw8kAUk4RfGpbnvGufh5TDD4=,tag:uT8J+MXCXhU6MFhgqTDJKQ==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.10.2

kubernetes/apps/authentik-db/objectstore.yaml

@@ -15,6 +15,12 @@ spec:
       secretAccessKey:
         name: barman-cloud-creds
         key: ACCESS_SECRET_KEY
+      # Garage requires an explicit region — without it boto3's
+      # HeadBucket call (used by barman-cloud-check-wal-archive during
+      # CNPG bootstrap.recovery) returns 400 Bad Request.
+      region:
+        name: barman-cloud-creds
+        key: REGION
     wal:
       compression: gzip
       encryption: AES256

kubernetes/apps/paperless-db/barman-creds.sops.yaml

@@ -7,6 +7,7 @@ type: Opaque
 stringData:
     ACCESS_KEY_ID: ENC[AES256_GCM,data:jPZ9fJV6J2sDNH40BrYZMFE9oUlmX9wwg1c=,iv:Y+jA6JQZCWjQzo5QJVyMcty0em4HGARxMO0rrP5URBw=,tag:2nJa8QKjvjLxgeKWnJtUDw==,type:str]
     ACCESS_SECRET_KEY: ENC[AES256_GCM,data:Z6+mX2hCcgeOKVqjgYHI4RGKtuERk+AMMBVjmolVCgcR6xG0ealciGmJYnSSR5OGaVPd9lTnbNc80JA+2cHqDw==,iv:+TlWd9v93SyDiMWTqyW51Hf+2kBai/Xw9Ry0WFufmzE=,tag:GEnPofL/n/NFeA7Y8CkJsw==,type:str]
+    REGION: ENC[AES256_GCM,data:eOE9Xhip,iv:pjp801ZzDxQSP3Md7ksPb7rL9BeMq70Rrv17a0Bc3wM=,tag:PbyYzkqkqP1FI04r3O6wRg==,type:str]
 sops:
     age:
         - recipient: age1yqjvqkwwwxdj7mr546zfs5ckzuwndp69ya2n2drd4vypwns8w4ys04qfy3
@@ -18,7 +19,7 @@ sops:
             NnZma2FKWkVyb0lBaXJNcmZacC81eDgKs7TeS9QBlziLPf0z5mG8DlasAHwPZpeZ
             TOugJ8njqn6wD4zAsxonc161PFLPPWCQfOX4DfrV4q6GsABD1crrGw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-04-20T13:25:00Z"
-    mac: ENC[AES256_GCM,data:RUZTBNWyal+APtw8gdBLuGPUDTx104x5DQ5imNKx+vCCxHNIsdhreHxRIMtgPeCyoQD5Swp8NBXP1iw0Bd/K8cPDSR1FO1757Uxtcus/149WUFcliK13MxwvSD6c3KKrsGPH8ucZeKm7J609Vt1GhygEQwgsVkPv8NYjfuelukI=,iv:AlnL3oTJZDeG+d3xNbaI+SHBGBK+z0WVfXYg0+6PCrI=,tag:1qTOnqZvhqHXPjzS6kfooA==,type:str]
+    lastmodified: "2026-04-20T21:02:22Z"
+    mac: ENC[AES256_GCM,data:X4pyYg/6wweFUx3HBUjJKk4Hl6OT+h7Q4xt1LL6Le72oXh84vPfS/o6W6Nl5ZYv1OAE3cE9L1P+jdP4BS6lDh3RdOsYoBQTq85j2ejukTSSYcIE7SdBPddkkZp9hHPZYMRTrYOFmyNQStN75rYw5FpEd2kOs9RSCN1NRxXrbzYQ=,iv:YGoopg8hEb5bMo9zMJkA11uR36mOeXnQQraLCcNlgzc=,tag:D7oMNHsokuoPc9kd1C2qwg==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.10.2

kubernetes/apps/paperless-db/objectstore.yaml

@@ -15,6 +15,9 @@ spec:
       secretAccessKey:
         name: barman-cloud-creds
         key: ACCESS_SECRET_KEY
+      region:
+        name: barman-cloud-creds
+        key: REGION
     wal:
       compression: gzip
       encryption: AES256