feat(storage): migrate 12 SQLite NFS PVCs to proxmox-lvm (Wave 1)

Add proxmox-lvm PVCs with pvc-autoresizer annotations for all
SQLite-backed services. Deployments updated to use new block storage
PVCs. Old NFS modules retained for 1-week rollback.

Services: ntfy, freshrss, insta2spotify, actualbudget (x3),
wealthfolio, navidrome (DB only), audiobookshelf config,
headscale, forgejo, uptime-kuma.

Also: set Recreate strategy on ntfy, forgejo, insta2spotify,
wealthfolio (required for RWO volumes).

stacks/forgejo/main.tf

@@ -28,6 +28,28 @@ module "nfs_data" {
   nfs_path   = "/mnt/main/forgejo"
 }
 
+resource "kubernetes_persistent_volume_claim" "data_proxmox" {
+  wait_until_bound = false
+  metadata {
+    name      = "forgejo-data-proxmox"
+    namespace = kubernetes_namespace.forgejo.metadata[0].name
+    annotations = {
+      "resize.topolvm.io/threshold"     = "80%"
+      "resize.topolvm.io/increase"      = "50%"
+      "resize.topolvm.io/storage_limit" = "20Gi"
+    }
+  }
+  spec {
+    access_modes       = ["ReadWriteOnce"]
+    storage_class_name = "proxmox-lvm"
+    resources {
+      requests = {
+        storage = "5Gi"
+      }
+    }
+  }
+}
+
 resource "kubernetes_deployment" "forgejo" {
   metadata {
     name      = "forgejo"
@@ -40,7 +62,7 @@ resource "kubernetes_deployment" "forgejo" {
   spec {
     replicas = 1
     strategy {
-      type = "RollingUpdate" # DB is external so we can roll
+      type = "Recreate"
     }
     selector {
       match_labels = {
@@ -110,7 +132,7 @@ resource "kubernetes_deployment" "forgejo" {
         volume {
           name = "data"
           persistent_volume_claim {
-            claim_name = module.nfs_data.claim_name
+            claim_name = kubernetes_persistent_volume_claim.data_proxmox.metadata[0].name
           }
         }
       }