feat(apps): Add pgweb

add-ons/postgres/cluster.yaml

@@ -24,6 +24,13 @@ spec:
         name: legislative
         passwordSecret:
           name: legislative-db
+      - ensure: present
+        inRoles:
+          - pg_read_all_data
+        login: true
+        name: pgweb
+        passwordSecret:
+          name: pgweb-db
       - ensure: present
         login: true
         name: redoost
@@ -31,8 +38,12 @@ spec:
           name: redoost-db
   postgresql:
     # Each app role may only connect to the database of the same name.
+    # pgweb is read-only and may browse every database except authentik's,
+    # which holds credentials and session tokens.
     pg_hba:
       - host sameuser all all scram-sha-256
+      - host authentik pgweb all reject
+      - host all pgweb all scram-sha-256
       - host all all all reject
   resources:
     limits: