Consolidate Forgejo backup into forgejo namespace

Move backup resources from separate 'backup' namespace to 'forgejo':
- Change CronJob namespace from 'backup' to 'forgejo'
- Reuse existing forgejo-postgres-secret instead of duplicate backup secret
- Remove backup-namespace.yaml (no longer needed)
- Remove forgejo-backup-secret-sealed.yaml (using existing secret)

This simplifies the architecture by keeping all Forgejo-related
resources in a single namespace and eliminating credential duplication.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

DEV-349-progress.md

@@ -0,0 +1,48 @@
+## Dozzle Deployment Progress
+
+### Completed
+
+1. ✅ Created deployment manifests in `apps/dozzle/` directory:
+   - Namespace, ServiceAccount with cluster-wide RBAC for pod log access
+   - PVC (1Gi, hcloud-volumes-encrypted, ReadWriteOnce with Recreate strategy)
+   - Deployment with oauth2-proxy sidecar for Pocket ID OIDC authentication
+   - Service routing to oauth2-proxy (port 4180)
+   - Ingress with TLS for `dozzle.basicstack.de`
+
+2. ✅ Created ArgoCD application (`app-dozzle.yaml`) with automated sync
+
+3. ✅ Created Pocket ID OIDC client:
+   - Client ID: `179c13f2-d251-4e1e-b1a0-c070df350c4e`
+   - Callback URL: `https://dozzle.basicstack.de/oauth2/callback`
+   - Sealed secret with client credentials and oauth2-proxy cookie secret
+
+4. ✅ Configured oauth2-proxy sidecar (running successfully)
+
+5. ✅ All manifests committed and pushed to repository
+
+### Current Blocker
+
+Dozzle container is failing to start with error: **"Could not connect to any Docker Engine"**
+
+**Root cause**: Dozzle v10.6.10 is not auto-detecting Kubernetes mode despite:
+- Proper RBAC permissions (ClusterRole with pods, pods/log, namespaces access)
+- Service account correctly mounted at `/var/run/secrets/kubernetes.io/serviceaccount/`
+- ClusterRoleBinding connecting service account to ClusterRole
+
+**Troubleshooting attempted**:
+- Tried various command-line flags (`--agent`, `--no-analytics`)
+- Verified RBAC permissions are correct
+- Checked service account token is mounted
+- oauth2-proxy sidecar is working correctly (1/2 containers ready)
+
+**Next steps**:
+1. Research Dozzle Kubernetes deployment examples/Helm charts for missing configuration
+2. Consider alternative: Try older Dozzle version or different container log viewer
+3. May need to explicitly configure Kubernetes API endpoint or use different deployment approach
+
+**Current pod status**:
+```
+dozzle-f4d557466-qh28j      1/2     CrashLoopBackOff
+```
+
+All infrastructure is in place; just need to resolve Dozzle's Kubernetes detection issue.

apps/forgejo/backup-namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: backup

apps/forgejo/forgejo-backup-cronjob.yaml

@@ -2,7 +2,7 @@ apiVersion: batch/v1
 kind: CronJob
 metadata:
   name: forgejo-backup
-  namespace: backup
+  namespace: forgejo
   labels:
     app: forgejo-backup
 spec:
@@ -59,17 +59,17 @@ spec:
             - name: POSTGRES_USER
               valueFrom:
                 secretKeyRef:
-                  name: forgejo-backup-secret
+                  name: forgejo-postgres-secret
                   key: POSTGRES_USER
             - name: POSTGRES_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: forgejo-backup-secret
+                  name: forgejo-postgres-secret
                   key: POSTGRES_PASSWORD
             - name: POSTGRES_DB
               valueFrom:
                 secretKeyRef:
-                  name: forgejo-backup-secret
+                  name: forgejo-postgres-secret
                   key: POSTGRES_DB
             volumeMounts:
             - name: backup-data

apps/forgejo/forgejo-backup-secret-sealed.yaml

@@ -1,18 +0,0 @@
----
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  creationTimestamp: null
-  name: forgejo-backup-secret
-  namespace: backup
-spec:
-  encryptedData:
-    POSTGRES_DB: AgBAaN4x6Izo1/jx7eeNHiDefYNqm+Mh482poUIxw+TgBlLloMDJ7biKazDiNUR+Ym7DniMjroVRjMc3Fi4hiqhcDBt06tuiKXe3qX2lEDwkZbe4mZ1VeqMgSqKbM0wY98y9XWN+G3JDHs5GYQsfJDXwQ9+QzOtNGByQw2Pi2jlov3xAo0vqZLucXPmzhhCDzR49CnaouR200U95vhXZesHF4un3qSFzmi5Ty2JGMd8gKo57OOkWs2GysAoMwDuAv5337aBkNicZK4M0ZtlyMS1YHKnHyxCeghAZPvrWTwLgy1mjP9pcZ+cFQB5qN8wIvXDh9URa6xhUB2QQB6+/1v7kFNisLHs1lTGjYnHPvdyXvFF+IIPfS0eqdz2X2aVRJCkBbiJgwTj1fBiBxdEZ/UP7qJUlemGWMn/lWiThubx3pMuqGHEKnEaCo6sC4GKneFkj6isIrmW6oVc9Xwj9QwL0ELglntteFp6/RSKkCgfHwt2BJQVMMRO7KSD3p1aFUy9bhOcecOrlVGWrEyKPZTTfCySLNi+Eg+3Pz3A2heiYid4X4Y4fQOOWYNz2nO5w2/aVvUsLXA7LbPp/7hg9BPDKmsgr48i2nJXzK9Gjt1cQuSiLy3kwQpry3nwPYclTdwVJTjprdRf0vAODq1ohaXfKoYOu/bvfKzWImqjWo7kB33qkQhT6xVocwadDrgmQlecxcM5eIInh
-    POSTGRES_PASSWORD: AgB9KzB//Le/OMAum6LXDjEw8bH4jaa149ROYUhe6aG2zxVsFJDK55xAxGCCCOt1dpxV/EtzfzQjbf/CCs37D6jnwqEjlE/yhIKTwRN43ns5MJ6UXoGZVRWbw/yWSR1Cb6Z7P1hPg/wBp9mImX2lU8fDqNLYEN5Mze56UBH12peFBGBWRdtFPUqXmVfxZ2nmgBP9sb8KcxP6iMMFcGf5eoBz0Yta2iha4DyMu2cD4lGUfc6ZN5VREAwyOcqgUfTlHmpz6BWBXIQR0hxE1wHDrjyWouxZT9uvjuKalTtE9cEwkZV8qKz8S9Ba7Ms7uMqOnJ4Cm3ODDvmEAlcgP3mYlaoCjhBA4LmVM72cv6wA6xg4qCunbJDM+5rB8RetXPDfhV4LcYZe6QDGj1As7ztoOdNhdvZQwICoH4660xnxLUYPRN1UGKyoMNHrxZuzMWxDgULRyrl7TDy+bKJHv74L9VOSjJnKw8ov7cuomrqnUdrq6eawQquxnJgY0jv4lDs1Xn/5Gq+72TBSHOS5k6E6p7aIfG0QeilOVQK+OetGOyCCEaTH7Zo7URpjHnY+571RSdV86hX+qXPZBwjtHnwjgi5HiGn41k7/R3OrtdTj8lnftn246YGaYlIZ1gPY7jUQKYzMxhthXSow6uBA8IBSBmBL3tS8D9qLfr9yXoJ5CwIlDx2P5XyzwQU0NaPWb0Um+XnxteJRSH4bOSM+O84T9n3oXNqAPWpUlJMkIW5+zaCxHxOiWw3ZJWX1UZRrzw==
-    POSTGRES_USER: AgBtQxQlKNvZbArIy4GTQd/J88Z6ShZoamMMw7sDSXsm0UwnToY8WKJflG+ydG3zzNCIfT1S2bcb0XVZbiDEgWySwct/CS6KtafLJqElJ9e65i4EOsdklBiUssjsceWC8yRoUIqrblwP6vqwrwhkdI46QaIcHJkdNmq/giT3yQqx35Mv/slJvoLwom76bZgs51jm22VjEAzcPA0d9rbe9flKXVGf6OmQpViMiV8OSDUgQ2Yjx6rQ5zFvCUdvoX6UIFxt9xmA75YiFgltxElOAWLRMa/CvdA6ZIY9jy1oD/gDIPjCL9pm4u5wM24mkQWMCfZiHAsDfkrxkMOsDlI8fRvFO4tMZgDnFNhi1EFOR1ga1WiK4NRKprKQ5WN0NjSuh59DxGSuKrg0WQjg88oXUdfYg7d9oqZiL7WUWVMWwtyLyW1wKuVR8qIoPxYcY88BaEOtw7tQ8odNszWBigsXCeHP9zVpVQjdPhDyGiN38MqftqQS1ywj/oLHWBC2UbH09I1VuAokiUl92CBAt7EiuvyVyYBv0yZlFT6ReatPeUfCWfAWmXkTg6iOiW+Y4+9HPuhBVjhyUw20WifEajNAbva8azSyc4S1LIIOpIlvoQp9joG7a65yRFjt1KzFoh4KDg+WJC1MNtBgqvMBS/4jOiBcrYh2lKIgGO/kBznPqVlZCDn8tdJyxGth56Td/QGfLdCPOxea1g8q
-  template:
-    metadata:
-      creationTimestamp: null
-      name: forgejo-backup-secret
-      namespace: backup
-    type: Opaque