feat(chart): support external postgres and secret-sourced db passwords

[sabinem]

The chart addressed postgres by a name derived from its own release and rendered the backend's database password into a ConfigMap, so it could only ever talk to the postgres it installed itself, with a password copied into a values file.

• backend.config.database.host is now read (it was documented but inert); empty still falls back to -postgresql.
• backend.config.database.existingSecret / existingSecretPasswordKey let an operator or secret store own the credentials. The same keys under keycloak.database.external are passed to the keycloak subchart.
• The password now always travels in a Secret, chart-managed when no existingSecret is given, injected as HACKAGON_DATABASE_PASSWORD, which koanf layers over the mounted config.yaml. No backend change needed.
• keycloak-init-configmap is gated on postgresql.enabled: an external postgres is expected to have its roles already, so neither password has to be supplied in plaintext.
• validations.yaml collects the combinations the chart cannot render, replacing two assigned-but-unused variables in keycloak-realm-configmap that existed only to force a required.
• Fix keycloak.database.external.database/.user, which the subchart reads as name/username, so both were silently ignored.

Chart version 0.4.0 -> 0.5.0.