vad: processing, flows, issues, bim

processing needs smtp_auth (newly enabled, generate:true placeholder
- non-functional SMTP but structurally valid so the pod starts).
flows reads the already-existing apps/documentations/postgres secret
(read-only grant, no new database). issues' S3 uses the eav admin
creds like django/documentations; note the app itself hardcodes the
bucket name to "rfi" instead of "issues" - pre-existing bug, not
fixed here. bim only needs its own postgres, same as sarex-contour.

Pinned the shared vault/common/django_auth to the real sarex-backend
superuser (hagen013) so issues' API calls actually authenticate -
the other consumers (workspaces, django, documentations, notes,
contracts) only use the raw token for inter-service basic auth trust
and don't care about the specific value.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

infrastructure.yaml

@@ -685,6 +685,18 @@ environments:
       - name: documentations
         manage: false
         image_pull_secret: true
+      - name: processing
+        manage: false
+        image_pull_secret: true
+      - name: flows
+        manage: false
+        image_pull_secret: true
+      - name: issues
+        manage: false
+        image_pull_secret: true
+      - name: bim
+        manage: false
+        image_pull_secret: true
 
     postgresql:
       default_host: 192.168.8.131
@@ -820,6 +832,49 @@ environments:
           password_special: false
           conn_limit: 20
 
+      - cluster_id: main
+        database:
+          name: processing
+          extensions: []
+        user:
+          name: processing
+          password_length: 32
+          password_special: false
+          conn_limit: 20
+
+      - cluster_id: main
+        database:
+          name: flows
+          extensions: []
+        user:
+          name: flows
+          password_length: 32
+          password_special: false
+          conn_limit: 20
+
+      - cluster_id: main
+        database:
+          name: issues
+          extensions: []
+        user:
+          name: issues
+          password_length: 32
+          password_special: false
+          conn_limit: 20
+
+      - cluster_id: main
+        database:
+          name: bim
+          extensions:
+            - ltree
+            - uuid-ossp
+            - pg_stat_statements
+        user:
+          name: bim
+          password_length: 32
+          password_special: false
+          conn_limit: 20
+
     minio:
       endpoint: http://192.168.8.121:9000
 
@@ -842,6 +897,9 @@ environments:
       - name: documentations
         acl: private
 
+      - name: issues
+        acl: private
+
     kafka:
       create_acls: false
       kafka_cluster_refs:
@@ -876,6 +934,9 @@ environments:
         - name: contracts
         - name: django
         - name: cde
+        - name: processing
+        - name: flows
+        - name: issues
       users:
         - name: notes
           password_length: 32
@@ -887,6 +948,12 @@ environments:
           password_length: 32
         - name: cde
           password_length: 32
+        - name: processing
+          password_length: 32
+        - name: flows
+          password_length: 32
+        - name: issues
+          password_length: 32
       permissions:
         - vhost: notes
           user: notes
@@ -913,6 +980,21 @@ environments:
           configure: ".*"
           write: ".*"
           read: ".*"
+        - vhost: processing
+          user: processing
+          configure: ".*"
+          write: ".*"
+          read: ".*"
+        - vhost: flows
+          user: flows
+          configure: ".*"
+          write: ".*"
+          read: ".*"
+        - vhost: issues
+          user: issues
+          configure: ".*"
+          write: ".*"
+          read: ".*"
 
   sarex-contour:
     postgresql: