extract dbaas, authentik, crowdsec from platform into independent stacks [ci skip]

Phase 1 of platform stack split for parallel CI applies.
All 3 modules were fully independent (no cross-module refs).
State migrated via terraform state mv. All 3 stacks applied
with zero changes (dbaas had pre-existing ResourceQuota drift).
Woodpecker pipeline updated to run extracted stacks in parallel.

stacks/dbaas/main.tf

@@ -0,0 +1,27 @@
+# =============================================================================
+# DBaaS Stack — MySQL + PostgreSQL + pgAdmin
+# =============================================================================
+
+variable "tls_secret_name" { type = string }
+variable "nfs_server" { type = string }
+variable "prod" {
+  type    = bool
+  default = false
+}
+
+data "vault_kv_secret_v2" "secrets" {
+  mount = "secret"
+  name  = "platform"
+}
+
+module "dbaas" {
+  source                   = "./modules/dbaas"
+  prod                     = var.prod
+  tls_secret_name          = var.tls_secret_name
+  nfs_server               = var.nfs_server
+  dbaas_root_password      = data.vault_kv_secret_v2.secrets.data["dbaas_root_password"]
+  postgresql_root_password = data.vault_kv_secret_v2.secrets.data["dbaas_postgresql_root_password"]
+  pgadmin_password         = data.vault_kv_secret_v2.secrets.data["dbaas_pgadmin_password"]
+  kube_config_path         = var.kube_config_path
+  tier                     = local.tiers.cluster
+}