fix(k8s): add datasource/kafka/redis config to k8s profile

K8s profile relied on shared/dev defaults for spring.datasource.url, but those
live inside the dev profile block — invisible when k8s profile is active.
Result: 'APPLICATION FAILED TO START — Failed to configure a DataSource'.

Move full datasource (and kafka/redis for projection-writer) wiring into the
k8s profile section. ENV vars come from Vault Agent injector
(ORDINIS_PG_USER/PASSWORD, ORDINIS_KAFKA_USER/PASSWORD, ORDINIS_REDIS_PASSWORD)
and chart-supplied ENV (ORDINIS_PG_HOST, ORDINIS_KAFKA_BOOTSTRAP, etc).

ordinis-app/src/main/resources/application.yml

@@ -133,6 +133,27 @@ spring:
         enabled: true
         backend: secret
         application-name: ordinis/cuod
+  datasource:
+    url: jdbc:postgresql://${ORDINIS_PG_HOST}:${ORDINIS_PG_PORT:5432}/${ORDINIS_PG_DB:ordinis}
+    username: ${ORDINIS_PG_USER}
+    password: ${ORDINIS_PG_PASSWORD}
+    driver-class-name: org.postgresql.Driver
+  kafka:
+    bootstrap-servers: ${ORDINIS_KAFKA_BOOTSTRAP}
+    properties:
+      security.protocol: ${ORDINIS_KAFKA_SECURITY:SASL_PLAINTEXT}
+      sasl.mechanism: ${ORDINIS_KAFKA_SASL_MECHANISM:SCRAM-SHA-512}
+      sasl.jaas.config: >-
+        org.apache.kafka.common.security.scram.ScramLoginModule required
+        username="${ORDINIS_KAFKA_USER}"
+        password="${ORDINIS_KAFKA_PASSWORD}";
+    producer:
+      acks: all
+      key-serializer: org.apache.kafka.common.serialization.StringSerializer
+      value-serializer: org.apache.kafka.common.serialization.StringSerializer
+      properties:
+        enable.idempotence: true
+        compression.type: lz4
   jpa:
     hibernate:
       ddl-auto: validate

ordinis-projection-writer/src/main/resources/application.yml

@@ -114,8 +114,35 @@ spring:
         backend: secret
         application-name: ordinis/cuod
   datasource:
+    url: jdbc:postgresql://${ORDINIS_PG_HOST}:${ORDINIS_PG_PORT:5432}/${ORDINIS_PG_DB:ordinis}
+    username: ${ORDINIS_PG_USER}
+    password: ${ORDINIS_PG_PASSWORD}
+    driver-class-name: org.postgresql.Driver
     hikari:
       read-only: true
+  data:
+    redis:
+      host: ${ORDINIS_REDIS_HOST:ordinis-redis}
+      port: ${ORDINIS_REDIS_PORT:6379}
+      password: ${ORDINIS_REDIS_PASSWORD:}
+      timeout: 2s
+  kafka:
+    bootstrap-servers: ${ORDINIS_KAFKA_BOOTSTRAP}
+    properties:
+      security.protocol: ${ORDINIS_KAFKA_SECURITY:SASL_PLAINTEXT}
+      sasl.mechanism: ${ORDINIS_KAFKA_SASL_MECHANISM:SCRAM-SHA-512}
+      sasl.jaas.config: >-
+        org.apache.kafka.common.security.scram.ScramLoginModule required
+        username="${ORDINIS_KAFKA_USER}"
+        password="${ORDINIS_KAFKA_PASSWORD}";
+    consumer:
+      group-id: ordinis-projection-cuod
+      auto-offset-reset: earliest
+      enable-auto-commit: false
+      key-deserializer: org.apache.kafka.common.serialization.StringDeserializer
+      value-deserializer: org.apache.kafka.common.serialization.StringDeserializer
+    listener:
+      ack-mode: record
   jpa:
     hibernate:
       ddl-auto: none

ordinis-read-api/src/main/resources/application.yml

@@ -111,6 +111,10 @@ spring:
         backend: secret
         application-name: ordinis/cuod
   datasource:
+    url: jdbc:postgresql://${ORDINIS_PG_HOST}:${ORDINIS_PG_PORT:5432}/${ORDINIS_PG_DB:ordinis}
+    username: ${ORDINIS_PG_USER}
+    password: ${ORDINIS_PG_PASSWORD}
+    driver-class-name: org.postgresql.Driver
     hikari:
       read-only: true
   jpa: