vad: workspaces postgres db + vault wiring

Enables app-level policy/role creation for vad (was fully disabled),
adds the workspaces database and a v2 secrets entry that pulls the
generated password from live/database via dependency block.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

infrastructure.yaml

@@ -661,6 +661,9 @@ environments:
       - name: postgresql
         manage: false
         image_pull_secret: true
+      - name: workspaces
+        manage: false
+        image_pull_secret: true
 
     postgresql:
       default_host: 192.168.8.131
@@ -707,6 +710,17 @@ environments:
           password_special: false
           conn_limit: 20
 
+      - cluster_id: main
+        database:
+          name: workspaces_db
+          extensions:
+            - uuid-ossp
+        user:
+          name: workspaces
+          password_length: 32
+          password_special: false
+          conn_limit: 20
+
     minio: {}
     buckets: []