vad: attachments, bi, comparisons, drawings, inspections, mapper, measurements, subscriptions, system-log, transmittal

Same shapes already proven for sarex-contour: kafka for
inspections/mapper/system-log via the self-contained generate:true
path (field shape mismatch with the v2 type), S3 via the eav/django
admin credentials. subscriptions gets postgis declared per explicit
instruction - not installed on vad's postgres yet, needs to be done
out of band since I have no SSH access there.

transmittal additionally needs a one-off opaque secret at
vault/apps/transmittal (mailgun API key) - a random placeholder via
the v2 secrets type=opaque/random_keys, since there's no real mailgun
account and the app only needs the field to be present.

5 pure-frontend apps also wired in this push (cross-section,
document-link, prescriptions, projects, stamp-verification) - no
vault dependencies, namespaces added for regcred only.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

infrastructure.yaml

@@ -697,6 +697,51 @@ environments:
       - name: bim
         manage: false
         image_pull_secret: true
+      - name: attachments
+        manage: false
+        image_pull_secret: true
+      - name: bi
+        manage: false
+        image_pull_secret: true
+      - name: comparisons
+        manage: false
+        image_pull_secret: true
+      - name: drawings
+        manage: false
+        image_pull_secret: true
+      - name: inspections
+        manage: false
+        image_pull_secret: true
+      - name: mapper
+        manage: false
+        image_pull_secret: true
+      - name: measurements
+        manage: false
+        image_pull_secret: true
+      - name: subscriptions
+        manage: false
+        image_pull_secret: true
+      - name: system-log
+        manage: false
+        image_pull_secret: true
+      - name: transmittal
+        manage: false
+        image_pull_secret: true
+      - name: cross-section
+        manage: false
+        image_pull_secret: true
+      - name: document-link
+        manage: false
+        image_pull_secret: true
+      - name: prescriptions
+        manage: false
+        image_pull_secret: true
+      - name: projects
+        manage: false
+        image_pull_secret: true
+      - name: stamp-verification
+        manage: false
+        image_pull_secret: true
 
     postgresql:
       default_host: 192.168.8.131
@@ -875,6 +920,113 @@ environments:
           password_special: false
           conn_limit: 20
 
+      - cluster_id: main
+        database:
+          name: attachments
+          extensions: []
+        user:
+          name: attachments
+          password_length: 32
+          password_special: false
+          conn_limit: 20
+
+      - cluster_id: main
+        database:
+          name: bi
+          extensions: []
+        user:
+          name: bi
+          password_length: 32
+          password_special: false
+          conn_limit: 20
+
+      - cluster_id: main
+        database:
+          name: comparisons
+          extensions:
+            - uuid-ossp
+            - pg_stat_statements
+        user:
+          name: comparisons
+          password_length: 32
+          password_special: false
+          conn_limit: 20
+
+      - cluster_id: main
+        database:
+          name: drawings
+          extensions:
+            - uuid-ossp
+            - pg_stat_statements
+            - ltree
+        user:
+          name: drawings
+          password_length: 32
+          password_special: false
+          conn_limit: 20
+
+      - cluster_id: main
+        database:
+          name: inspections
+          extensions:
+            - uuid-ossp
+            - pg_stat_statements
+        user:
+          name: inspections
+          password_length: 32
+          password_special: false
+          conn_limit: 20
+
+      - cluster_id: main
+        database:
+          name: mapper
+          extensions:
+            - uuid-ossp
+            - pg_stat_statements
+            - ltree
+        user:
+          name: mapper
+          password_length: 32
+          password_special: false
+          conn_limit: 20
+
+      - cluster_id: main
+        database:
+          name: subscriptions
+          extensions:
+            - uuid-ossp
+            - pg_stat_statements
+            - postgis
+        user:
+          name: subscriptions
+          password_length: 32
+          password_special: false
+          conn_limit: 20
+
+      - cluster_id: main
+        database:
+          name: system_log
+          extensions:
+            - uuid-ossp
+            - pg_stat_statements
+        user:
+          name: system_log
+          password_length: 32
+          password_special: false
+          conn_limit: 20
+
+      - cluster_id: main
+        database:
+          name: transmittal
+          extensions:
+            - uuid-ossp
+            - pg_stat_statements
+        user:
+          name: transmittal
+          password_length: 32
+          password_special: false
+          conn_limit: 20
+
     minio:
       endpoint: http://192.168.8.121:9000
 
@@ -900,6 +1052,21 @@ environments:
       - name: issues
         acl: private
 
+      - name: attachments
+        acl: private
+
+      - name: mapper
+        acl: private
+
+      - name: measurements
+        acl: private
+
+      - name: subscriptions
+        acl: private
+
+      - name: transmittal
+        acl: private
+
     kafka:
       create_acls: false
       kafka_cluster_refs:
@@ -937,6 +1104,8 @@ environments:
         - name: processing
         - name: flows
         - name: issues
+        - name: mapper
+        - name: transmittal
       users:
         - name: notes
           password_length: 32
@@ -950,6 +1119,10 @@ environments:
           password_length: 32
         - name: processing
           password_length: 32
+        - name: mapper
+          password_length: 32
+        - name: transmittal
+          password_length: 32
         - name: flows
           password_length: 32
         - name: issues
@@ -995,6 +1168,16 @@ environments:
           configure: ".*"
           write: ".*"
           read: ".*"
+        - vhost: mapper
+          user: mapper
+          configure: ".*"
+          write: ".*"
+          read: ".*"
+        - vhost: transmittal
+          user: transmittal
+          configure: ".*"
+          write: ".*"
+          read: ".*"
 
   sarex-contour:
     postgresql: