authentik: cap ak-pg smartShutdownTimeout to 10s

ak-pg failover/switchover caused ~2.7min of app downtime. Root cause: on
demotion CNPG immediately drops the old primary from the -rw service
(role->unhealthy), but only promotes the replacement after the old primary is
fully down. The default smart shutdown waits smartShutdownTimeout=180s for
client connections to drain; Authentik's persistent connections never do, so
-rw stays backendless (clients get "No route to host") for the full window.
Postgres promotion itself is ~3s.

Capping smartShutdownTimeout at 10s bounds the backendless window to ~10-15s
(fast shutdown + promotion). Applied to ak-pg first per staged-rollout; pprl-pg
and im-pg to follow after validation.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

kubernetes/seed/authentik/cluster.yaml

@@ -5,6 +5,13 @@ metadata:
   namespace: authentik
 spec:
   instances: 2
+  # Cap graceful-drain on demotion: on failover/switchover the old primary is
+  # removed from the -rw service immediately, but the new primary is only
+  # promoted once the old one is down. The default smart-shutdown waits 180s
+  # for client connections to drain (Authentik holds persistent conns), leaving
+  # -rw backendless that whole time. Capping at 10s bounds failover downtime to
+  # ~10-15s (fast shutdown + promotion).
+  smartShutdownTimeout: 10
   imageName: ghcr.io/cloudnative-pg/postgresql:16
   enableSuperuserAccess: true
   storage: