add postiz + instagram-poster stacks for IG Stories pipeline

New stacks:
- stacks/postiz/ — Postiz scheduler (Helm chart v1.0.5, image v2.21.7)
  with bundled PG/Redis, /uploads PVC on proxmox-lvm, JWT_SECRET
  via ESO from secret/instagram-poster.
- stacks/instagram-poster/ — custom Python service that polls Immich
  for the 'instagram' tag, reformats photos to 9:16 with blurred-bg
  letterbox, exposes /image/<asset_id> publicly so Postiz can fetch.
  Image: forgejo.viktorbarzin.me/viktor/instagram-poster.

n8n: 3 new workflows (discover, approval, post) for the Telegram
inline-button approval UX. Adds ExternalSecret + env vars for
TELEGRAM_BOT_TOKEN, TELEGRAM_CHAT_ID, IMMICH_API_KEY, plus static
URLs for the new service.

Vault: seed secret/instagram-poster with telegram_bot_token,
telegram_chat_id, immich_api_key, postiz_api_token,
postiz_jwt_secret before applying.

stacks/postiz/modules/postiz/variables.tf

@@ -0,0 +1,40 @@
+variable "tls_secret_name" {
+  type        = string
+  sensitive   = true
+  description = "Name of the wildcard TLS Secret to copy into the postiz namespace."
+}
+
+variable "tier" {
+  type        = string
+  description = "Workload tier label applied to the namespace (e.g. 4-aux)."
+}
+
+variable "namespace" {
+  type        = string
+  default     = "postiz"
+  description = "Kubernetes namespace for Postiz."
+}
+
+variable "host" {
+  type        = string
+  default     = "postiz"
+  description = "Ingress hostname label (joined with root_domain by ingress_factory)."
+}
+
+variable "image_tag" {
+  type        = string
+  default     = "v2.21.7"
+  description = "Postiz container image tag."
+}
+
+variable "chart_version" {
+  type        = string
+  default     = "1.0.5"
+  description = "Postiz Helm chart version (OCI ghcr.io/gitroomhq/postiz-helmchart)."
+}
+
+variable "storage_size" {
+  type        = string
+  default     = "20Gi"
+  description = "Persistent volume size for /uploads."
+}