fix: add CockroachDB init Job for user/privilege creation

[krajtar]

Problem

CockroachDB runs with start-single-node --insecure. The user and database are created implicitly on first PV initialization, but there is no guarantee that:

1. The user (selfhost) has been created with the password from the Secret
2. The user has grants on all schemas (including ones created later by Huly services, e.g. hulykvs)
3. Default privileges are set so future schemas/tables grant access to the user

When ArgoCD recreates the cockroach pod (or the PV is lost), the user/privileges must be re-established. Currently there is no mechanism for this — it requires manual SQL intervention.

Fix

Add a Helm post-install,post-upgrade hook Job that:

1. Waits for CockroachDB to accept connections (reuses huly.waitForCockroach helper)
2. Creates the database and user if they don't exist
3. Sets the user password from the Secret
4. Grants ALL on the database to the user
5. Grants ALL on all existing schemas (excluding system schemas)
6. Sets ALTER DEFAULT PRIVILEGES so future schemas/tables are automatically accessible

The job uses helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded so it runs on every upgrade but cleans up after itself.

Backward compatibility

• On first install: creates user, database, grants (idempotent — IF NOT EXISTS)
• On upgrade: re-grants privileges, sets default privileges (idempotent)
• No values changes needed
• Uses the same cockroach image already configured in cockroach.image