fix(plataforma): quota, TLS do Postgres e NetworkPolicy de metrica

A quota copiada do molde (limits.cpu 4) impedia Keycloak, bff e captacao de criar
pod: os 8 deployments somam 6,2 CPU de limites. Redimensionada para 8 CPU / 8Gi,
e nao copiada do piloto, que roda 18 deployments.

O postgres ficava em ContainerCreating por montar um volume `postgres-tls` que
nao existia: e a mudanca de P2.2, preparada e nunca aplicada neste cluster.
Certificado gerado e selado para este namespace.

Acrescentado o 60-monitoring-netpol.yaml, que nao existia no molde. Sem ele o
tenant funciona e fica invisivel no Grafana. Seleciona os cinco pods de aplicacao
que existem aqui, e nao `app: backend` como o do piloto.

tenants/plataforma/00-namespace-quota-netpol.yaml

@@ -17,10 +17,26 @@ metadata:
   namespace: plataforma-prod
 spec:
   hard:
+    # Dimensionada para ESTE tenant, e nao copiada.
+    #
+    # A copia que veio do `tenants/piloto` do repositorio de codigo trazia
+    # limits.cpu 4, e com ela o Keycloak, o bff e o captacao NAO conseguiram
+    # nem criar pod: "exceeded quota: tenant-quota, requested: limits.cpu=1,
+    # used: 3700m, limited: 4". Os limites dos 8 deployments somam 6,2 CPU
+    # contando o default do LimitRange no postgres.
+    #
+    # O numero do piloto no cluster e outro — limits.cpu 20, memory 16Gi,
+    # pods 30 — porque aquele tenant roda 18 deployments. Aqui sao 8, entao
+    # copiar 20 seria pedir folga que este tenant nao usa.
+    #
+    # `limits` e teto, nao reserva: o no ja opera com 836% de limits.cpu
+    # comprometidos, o que e pratica normal. O que reserva de verdade e
+    # `requests`, e ai a conta importa: o no tem 8 CPU e 32Gi, com 74% da CPU
+    # e 72% da memoria ja reservados. Os 8 pods pedem ~2,1Gi.
     requests.cpu: "2"
-    requests.memory: 2Gi
-    limits.cpu: "4"
-    limits.memory: 6Gi
+    requests.memory: 3Gi
+    limits.cpu: "8"
+    limits.memory: 8Gi
     pods: "20"
     persistentvolumeclaims: "4"
 ---

tenants/plataforma/04-sealed-postgres-tls.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: postgres-tls
+  namespace: plataforma-prod
+spec:
+  encryptedData:
+    tls.crt: AgAVEc05agqoZeqKaXg4HmDwWwcn2x7720WNnB8O9moZQtBM0c/R/IJR7yIS75jIL2DGaqRXVyZJ7UyqEG0mT9S/+tuhoks6v1NJzEUVj8d0tBnYMpJXoCnmDMyKXo7YbvRnzM3SolHoaaE8oXJLdVNNF/xVdFiMLN7HqTwrREsLn9OBBnVnq+L816TcVuhA7IK1b+8jxl+5hXTqgETCeXwmgxsRu9VWspEKzn8bY3dqh9obraTjfv7LOBG5zWQg50Nl7k/LivzhSpPXkvUMCADT2K0NXi8cQ7XIdV9scBFpCHm1QgOWcRMc+hRsNxANEopeYQY3uN4MIQ7dHDssguHwfC85HTXBYhxKAVSdsBbT3ccFn5gj2/nEUWdkDZArEWgTQ+Jx+gXNBoVx3bMe736mEmtXhhpf1Nr0eC8R0s6AbFc50zU8VMUoaAxSRuoIJMfUBYshNsm6gNxQTG+RGdOn8GTOtyMsJdnALBpSuxP5UGS174YZ+JSxR6o04LvkBejNwdtfTMBPUf5pC9xe4RtIUODbzw9ePv4LhYwsxC2piWN9gnZ6kmB57Iu6mBaRHc8YKrbWuH1fZGbCTa48tV29/OoAxondPW6frATGKYYo8wff85u7TF8K4aAh1oTaFEHPJ9vAx6Z6ar+uxyxUOCaaJilxrmjd4hmli7oTzFB0TvYNgMxSuF1ve/Lr2MWNrYzkwQ/vop8O/ZAtji+64i7N1Mi4XQWGQxYqLDnVqpzFR24toHbMqdlsqFSKblS3EMMVY9f7ukr0bT95CK+zsx6rAfFZhXGWR1X6WWFLZMlZ6NOpv/L7efkW+lNUmyy1aCMkTDyyZJbZNjxIy9CT6r8OVgy/J5pW51VUn3r1LEQxwa5ZSSbxWd/QR09aHs62gBw/crvBXLtp6Btvly/ljxHvqKm4EQBOLXWL4zn6G7+12a++S4Jzn1pFnT+WjDebnYQgTEt4UrQZhM8uQSze+HoYkgPwpRvoTgWAbssOec4yHFxkBTq3TWDGg1aNpTyhaILLBh4DzjXxeP7sejGqPfABiwaxsLbvRt12rvV74sfa+pFQGbFg0CaK+l3jkbyKy36d7/AZNzH64MPYUnlqIpGbUJJpe8CqjeMJ77MqIGgX3+lsg+4NwdKdZ5fBVHpMhSmC+NiiDHnH8C4aMryvJzeLwW2DnXsx1/1+gl8mMCBSPlOue1AS3GZ37+GXMnTSpY52al5pgaJkCw5lco1Hvfgt0Dfdux7jXe0k8YnDAV8RNod5whRT7E8GQzwTdhRESovijxJsu7HNErOwfVTDQil8nEKRRWSTq5P3VCND8Sya88rMKFtQw9zUe0JID8TBgsvUWTHpzwOrO0lkQcRyEtiGf6RkmlprG4YNFt0ge7cXEoqoIFeFm6FDHOc+xwNNtuUYA+u3QuQEqd5Sv5SS6VPJSeABbcw0xPWIYREXDUWCUOiPNZ6ID15q8xaGFTqk4TrgvqZhgkSktjKC8LOFb7Xl8mYrRpBFOm7qclZcyduT2BUM/yxItpg4BTO8EcKbJNaasW0JAyW9w08zvVJ9O6eEhBR32XUkSTO+KNM2Jb8DSlA/tQHXzYfHWgYatAwtDRx+aE1XLskT7T6QbSBFDnpPxgZIWV0oD+etj/8CBtK7ostvn2/VLSJiSQop05eNgQUzaye1yhbo2OtCvuJ4Ue6pqPEiKNZzRqnFmejApAWgfyz/uU9gs/OtX2iv/MzGWEWJEVUc7cLnhRXHEL5ItluXAYAri9Am08g1cvOyn1/VkzB2+QOMXb1Z9bkp7/8989nSlZacw1vUqKzT58sQaG/Oj9duSwsWkk3rAlr9DtDOy0mCObGZh7Jl6LxrXyxUF3soIBYacDCOCuVAnqxFDBHkIlRkDXA4yen78o88QMIwRtm0CPP5YG+rSj854dvIEcoEbGokb28f/f9BmMfQKUKYWERPxp0Scn9UPjBcOqzN3QG9OPXXcPOuqrI7d0hnDdHSQRGNS98pMFj+L+GI/pqs6Ray17PJi48dcYwLkv+IpAHirmg9mGFDLjmuBfGv+h6sSV9EVOAYU6LOYkprag8kQQF7uD+dYq0VTGpdX9EykzfIjwag66ncxKe5OyWMRkGMgjD+y9Lfd/cYXFYZ6EgiKdYg9xmGN/NL7qUXBcWSjwp29bc2yVKceDnJUok63Ub2OOkllVUjzJA6ABGFZ36R2Ails+eVj170sa1DBqhajTJylRQ9pS8PYwLnbgV78XHrVSBWK6Vpy430Dfkb/TxOdvIakpyxlQWEUi/QlsTPqPqRlPql1fBr5QSyX9NMreA=
+    tls.key: AgBSyPYh10DdUXU3TDZ/yqR/iORBD1ToPlYwNJWn3hsRg62NpwqExduOe5+YsJ7JC7EjKDeg3OCjCx+m+Sfj76JoBojRuSzYSWOQ4q03V9MSnlmOyXhKi5pzQY2aiBiqAqVKLk6XVAf+z/E9KLMVEc7UmK2rZb0JnNOGnXU2dWkOSv8L8ewv5vXqK0ylxnQ0MeCFwBSq0bYKwRyfDzT51ESAxNN2m9eQ4R/3fM0RFyDAvByZbXy8UqMRpgLXpFxrcNz25ok/3zgbwpMZTaF7i+vZgqmxUQV/vcW979TcW2WsSt4wGLxxGayRdRxzDbhS/4mBhJoEGzeR2I4pVjpG9mfgIXk4zPjCVFLWpFoPskBI8AxHpofHkxToW45vfA6OBCy6UKgtNM1wmOrCSv25vUr/cyUEEo7dfNZywYzBFMT6Y1cn2ZCM9SP3ebcsDfphG4Faot9Zsm+0Txd7BDYu0MQNaMK2tIUXIGiAKQhHyznc1X6nZ9BexDsPjaxMwgB/OC/C0NTrpzonujb9e9t0g2PzHXOXnM+YdwkVMXKpYTyY0w+ews8XC9Z97s+tweT4uiU68DUU3fM96jH1GqvhL2Kcx/KquVDJurMGk6U5O6P0sbqJlB7b17PAZjj0JqtfML0xvLtZlmLjRhJW3Bv2msN4i6zduKtYrD42x0QzODnOG+4gtyHL80C7X2toY3QrJdiW0V4uMC6Z+8SWkYv95TmjGbUysxn96nr/sm/k23NVRxJEHNvSwa6sMyE01g6f4wQYA8ieiGS+Yc4MaVW5NfslSbsF/TW/Jp3geY4orCFKS9FqnVZZvB6jlvy0tkaWjnHgzyesixuOLEkC9XmtH5SHwe0oowBRIYTl/+gSKQrYs0crtpMjCm5GdEsjjuh1qNRTDIlfIJx8ETwMCo8oIqL9QcJuPlUAJWUDSZQIH1jbvQBGr3n9pag+t5H4fLCyj5yzDOuOueni8KM0ftiCQonysEd+2mKs1vo0zJ0dHjW6PFG54TiVDiZnGMc5Xiq3v5z0NoIlSbjGI80WR42NSvAHVp/v90q6aZy3ipgQQPMVp3r7Wbz2+kC2jAIOQh9E4s9UOX3DqJf2pYOGppzLoDHdCSqhFgZDXiNRuJvNOIx+1yEmpcMnC2u4y5QvLKi5YgRD177Lm8rl/7oU+Lk0r6JzKa0PXpGibssURKFflWgHoTTRtePlT4a3LREJvzU5Y9QY3Celr8ll/Ko2hjLFYEpFvJb30qM3eRBTBBrctw4kfXBkgISKIF/RE3lVXb+SIUyUh95cNLZKV8JwqAdqW3bCZ81XLM6UXpqWFFIhpih2D3Z4ehgAxE4Ljo7XCD0OOaGsjg8J5tbYLWzLtG5UalVlnWDbcPRJNyOSlV3e6qu5ZsebxXyJR1wDvFEi5CWo9pfk03pOymlQiBVC+Prn0m4VXBE+dyTCp3JICAXxcnOdmnetZHpQHXjMaDtAaSIA9br2nmMkNG4YDDxjVI8hWbC/BMkTtM69YUi5SN6IGR4dSmCJPQReonBICNYLCKRmm3LADg6hZgW8bi+q6pccJkvDzYwUvEr09HRNGGmo6Cgw3QITs7dKCChfSsB9jfNiiOzgkF+1u4Em/wjV267lPN+0+Dl3NYNds1G+dTzYsmpDzMJu5xIT0UqWNlcU+vqyKgn2Afb4wfJXjrJOvuWflD+7whDkUXG/4DUjbDgNxEsxmrME/KL2n4AGWfm7qYsBkP4mvr+rPBnpabd1P9whXCiQyPi9k2/YhcOc9UX8jsDErAhx7wHM+0ngw+/+CdLRfTr/+Ln53x2Rp6yKTsMfJqL67MUMkI51BmxqCWddQOYtvEMz2IJz6+0gKmF8Au9QfKXP6TTtVEYGWPPRno04fpMEDo8x8cEUiaAT0wA34oyboLdJMS76w2jlg8mhBhvGYov17jaoeQuj6YwMZvWPnc2+bpeqK3Q3ABeJQjbTqsfibVAMa5IeezupZ592/4tKND+nVXxBbEzZIaOtAhw2DDateVS6wZA0U2VeGyN5JrP1bW7MUgTc8cg+aGy+e+DOjwAprexZWynAxSyfErb0tfIGgQiJEpBel4EBAsQPaIU2248qYCD+reWWHmtssCx1je917V2bNCkv0s+eLnJw0mvjAPgcRvtAKGv90iW9TAQ8Jcj7iab/PamYB5MpbW+79b70YgLlBY+vennEJ/GCejU8Qu7nxfccekUYu6yv/Xj5nR0MkiHhi4hNCy0aQkS3qPYCDsf/HZYlik48G6xRsnxAfaHO6Tt+O6yM16romK4PyrREH2FvvNsmcDjaDyJNu8jEl1PjSJkmwDHRiBrbIS3OCQqPD3YNBNXfM0JnHP/ohbAGLuAopjH/QZX9Ouht5YLL59b7anpeaLDc0dexFnXCiWK+jwYu+4Bq7nLpznsMBthGZDvBWWdV2TAtwUqdwi11NDoYx2v87B/PDEUX0ByltGWAyH3U+/salBDOYUNC3s3iRNwbwI8cL92iBE074nv3DVy72lSbhW+htfkkB5Fe+jNFgCmqhX+SSPe+aqKkmzihihl3hzKmrw5YUWXPmt0kCnWZaizJxymS3GMyM8tIs8Ivf2kBoXMeJ6oEeETVOUFdchQtX2Vg+yU2BzsR8/RivYbR2PTz/MnPgZH8oefTC4d9PL8PS9DwqLk7RbrzUPx6NhW3Cnbq0OTrO4GdloE41Ct0FW6lZUDAtQ0wHIpXDgf6hM8a4ajJhSNV+xSzCCDq+o2KKHARwwRCJtW/i4MhRUwvpnKcDfIAFQ1w0t5zZTGylSyz7oh98MNlIVjn+coI48Otzg2//zzvDQmmr85E06LlEnyk9XdFrKBFZ/JCq/fMjhaRxkrvTAdK3BLhN77WzYbgBHFjFdZlaULhR00ctAPX+y09PtGqazAH1FI+95ICPfCBx1kemzxo2CPliaCoBxd43owMiPazUVo4eHoUKwK0anPVigywoXXPEX/K9SutIw==
+  template:
+    metadata:
+      creationTimestamp: null
+      name: postgres-tls
+      namespace: plataforma-prod
+    type: kubernetes.io/tls

tenants/plataforma/60-monitoring-netpol.yaml

@@ -0,0 +1,50 @@
+# Deixa o Prometheus raspar as metricas deste tenant.
+#
+# Aditivo a `deny-cross-tenant` (em `00-namespace-quota-netpol.yaml`), que
+# fecha ingresso de fora do namespace. Sem esta politica o tenant sobe, funciona
+# e fica INVISIVEL no Grafana — e um tenant sem metrica e um tenant em que
+# ninguem percebe consumo subindo nem pod reiniciando.
+#
+# ── Por que nao foi copiado do piloto ────────────────────────────────────────
+#
+# Este arquivo NAO existe no `tenants/piloto` do repositorio de codigo; so no
+# Gitea de dentro do cluster, que e a fonte real do GitOps. Foi encontrado em
+# 2026-09-17 ao comparar os dois, depois que a quota defasada do molde impediu
+# tres pods de subir.
+#
+# E o de la seleciona `app: backend` — o stub legado que P0.5 mediu nao atender
+# trafego nenhum. Copiado ao pe da letra, nao casaria com pod nenhum aqui, e o
+# tenant continuaria sem metrica com um arquivo que parece resolver o problema.
+# Por isso este seleciona os pods que EXISTEM neste tenant.
+#
+# A porta e 8083 nos quatro contextos e no bff, por convencao do projeto. O
+# `frontend-spa` (nginx, porta 80) nao expoe metrica em formato Prometheus e
+# fica de fora de proposito.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-monitoring
+  namespace: plataforma-prod
+spec:
+  # Sem `matchLabels` fixo: `In` cobre os cinco pods de aplicacao de uma vez, e
+  # um contexto novo entra acrescentando o nome aqui — em vez de exigir uma
+  # NetworkPolicy por servico.
+  podSelector:
+    matchExpressions:
+      - key: app
+        operator: In
+        values:
+          - servico-configuracao
+          - servico-cadastro
+          - servico-financeiro
+          - servico-captacao
+          - servico-bff
+  policyTypes: [Ingress]
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: monitoring
+      ports:
+        - protocol: TCP
+          port: 8083