vad: notes, rfi, checklists, contracts postgres/rabbitmq/kafka (stage 1)

checklists needs only postgres + the already-enabled rsa_keys, fully
wired in one push. notes/rfi/contracts also get real rabbitmq
vhosts/users (v2 secrets type, field shapes match app templates) and
self-contained kafka creds via the legacy generate:true path (same
precedent as sarex-contour - the v2 kafka type writes flat fields but
these apps read a nested auth.* object, so it doesn't fit).

S3 for notes/rfi/contracts is deliberately left out: same nested
client.endpoint shape mismatch as eav. Buckets ordered via live/s3;
vault.data.infrastructure.minio.apps entries follow in stage 2 once
the real generated credentials are known.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

infrastructure.yaml

@@ -667,6 +667,18 @@ environments:
       - name: eav
         manage: false
         image_pull_secret: true
+      - name: notes
+        manage: false
+        image_pull_secret: true
+      - name: rfi
+        manage: false
+        image_pull_secret: true
+      - name: checklists
+        manage: false
+        image_pull_secret: true
+      - name: contracts
+        manage: false
+        image_pull_secret: true
 
     postgresql:
       default_host: 192.168.8.131
@@ -734,6 +746,50 @@ environments:
           password_special: false
           conn_limit: 20
 
+      - cluster_id: main
+        database:
+          name: notes
+          extensions:
+            - uuid-ossp
+            - pg_stat_statements
+        user:
+          name: notes
+          password_length: 32
+          password_special: false
+          conn_limit: 20
+
+      - cluster_id: main
+        database:
+          name: rfi
+          extensions:
+            - uuid-ossp
+            - pg_stat_statements
+        user:
+          name: rfi
+          password_length: 32
+          password_special: false
+          conn_limit: 20
+
+      - cluster_id: main
+        database:
+          name: checklists
+          extensions: []
+        user:
+          name: checklists
+          password_length: 32
+          password_special: false
+          conn_limit: 20
+
+      - cluster_id: main
+        database:
+          name: contracts_db
+          extensions: []
+        user:
+          name: contracts
+          password_length: 32
+          password_special: false
+          conn_limit: 20
+
     minio:
       endpoint: http://192.168.8.121:9000
 
@@ -741,6 +797,15 @@ environments:
       - name: eav
         acl: private
 
+      - name: notes
+        acl: private
+
+      - name: rfi
+        acl: private
+
+      - name: contracts
+        acl: private
+
     kafka:
       create_acls: false
       kafka_cluster_refs:
@@ -769,6 +834,33 @@ environments:
     rabbitmq:
       amqp_host: rabbitmq.rabbitmq.svc.cluster.local
       amqp_port: 5672
+      vhosts:
+        - name: notes
+        - name: rfi
+        - name: contracts
+      users:
+        - name: notes
+          password_length: 32
+        - name: rfi
+          password_length: 32
+        - name: contracts
+          password_length: 32
+      permissions:
+        - vhost: notes
+          user: notes
+          configure: ".*"
+          write: ".*"
+          read: ".*"
+        - vhost: rfi
+          user: rfi
+          configure: ".*"
+          write: ".*"
+          read: ".*"
+        - vhost: contracts
+          user: contracts
+          configure: ".*"
+          write: ".*"
+          read: ".*"
 
   sarex-contour:
     postgresql: