vad: eav postgres db + role/policy (stage 1 of 2)

Adds the eav database and app policy/role/rsa_keys wiring. The minio
S3 secret for eav is deliberately left unset here: the new v2 secrets
contract writes flat s3 fields that don't match eav's expected nested
client.endpoint shape, so that secret has to be hand-populated with
the real live/s3-generated credentials in a follow-up commit. Until
then eav's pod will not start (agent-pre-populate-only needs every
declared secret path to resolve).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

infrastructure.yaml

@@ -664,6 +664,9 @@ environments:
       - name: workspaces
         manage: false
         image_pull_secret: true
+      - name: eav
+        manage: false
+        image_pull_secret: true
 
     postgresql:
       default_host: 192.168.8.131
@@ -721,8 +724,22 @@ environments:
           password_special: false
           conn_limit: 20
 
-    minio: {}
-    buckets: []
+      - cluster_id: main
+        database:
+          name: eav
+          extensions: []
+        user:
+          name: eav
+          password_length: 32
+          password_special: false
+          conn_limit: 20
+
+    minio:
+      endpoint: http://192.168.8.121:9000
+
+    buckets:
+      - name: eav
+        acl: private
 
     kafka:
       create_acls: false