vad: django + documentations

django and documentations get postgres, rabbitmq (django + a shared
cde vhost that documentations' hasher/marks depend on), and rsa_keys
(already enabled). Kafka for django uses the self-contained
generate:true path, same reasoning as notes/contracts.

S3 for both uses the eav admin credentials directly (per explicit
instruction) rather than the two-push bucket dance - buckets are
still ordered via live/s3 so they physically exist, but the vault
secret is wired with the admin key/secret right away.

documentations also needs two extra django_auth fields it reads as
raw JSON (documentations_s3_service_account_json and
_zitadel_account_json - a structurally-valid but non-functional
placeholder RSA key, same approach used for sarex-contour, since the
app only needs a decodable PEM at startup, not a working Zitadel
integration).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

infrastructure.yaml

@@ -679,6 +679,12 @@ environments:
       - name: contracts
         manage: false
         image_pull_secret: true
+      - name: django
+        manage: false
+        image_pull_secret: true
+      - name: documentations
+        manage: false
+        image_pull_secret: true
 
     postgresql:
       default_host: 192.168.8.131
@@ -790,6 +796,30 @@ environments:
           password_special: false
           conn_limit: 20
 
+      - cluster_id: main
+        database:
+          name: django
+          extensions: []
+        user:
+          name: django
+          password_length: 32
+          password_special: false
+          conn_limit: 20
+
+      - cluster_id: main
+        database:
+          name: documentations
+          extensions:
+            - ltree
+            - uuid-ossp
+            - pg_stat_statements
+            - timescaledb
+        user:
+          name: documentations
+          password_length: 32
+          password_special: false
+          conn_limit: 20
+
     minio:
       endpoint: http://192.168.8.121:9000
 
@@ -806,6 +836,12 @@ environments:
       - name: contracts
         acl: private
 
+      - name: django
+        acl: private
+
+      - name: documentations
+        acl: private
+
     kafka:
       create_acls: false
       kafka_cluster_refs:
@@ -838,6 +874,8 @@ environments:
         - name: notes
         - name: rfi
         - name: contracts
+        - name: django
+        - name: cde
       users:
         - name: notes
           password_length: 32
@@ -845,6 +883,10 @@ environments:
           password_length: 32
         - name: contracts
           password_length: 32
+        - name: django
+          password_length: 32
+        - name: cde
+          password_length: 32
       permissions:
         - vhost: notes
           user: notes
@@ -861,6 +903,16 @@ environments:
           configure: ".*"
           write: ".*"
           read: ".*"
+        - vhost: django
+          user: django
+          configure: ".*"
+          write: ".*"
+          read: ".*"
+        - vhost: cde
+          user: cde
+          configure: ".*"
+          write: ".*"
+          read: ".*"
 
   sarex-contour:
     postgresql: