feat: improve security and stability for Vaultwarden and CodiMD

Security:
- Move Vaultwarden ADMIN_TOKEN to Secret (was plaintext)
- Remove root user execution from CodiMD (runAsUser: 0)
- Use fixed image versions instead of latest tag

Stability:
- Add liveness/readiness probes to Vaultwarden, CodiMD, CodiMD DB
- Add resource requests/limits to all services
- Set appropriate memory/CPU constraints

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

apps/codimd/manifests/03-codimd-db-deployment.yaml

@@ -17,6 +17,13 @@ spec:
       containers:
         - name: postgres
           image: postgres:17-alpine
+          resources:
+            requests:
+              memory: "128Mi"
+              cpu: "100m"
+            limits:
+              memory: "512Mi"
+              cpu: "500m"
           env:
             - name: POSTGRES_USER
               value: "codimd"
@@ -29,6 +36,27 @@ spec:
                   key: POSTGRES_PASSWORD
             - name: PGDATA
               value: "/var/lib/postgresql/data/pgdata"
+          # Health check
+          livenessProbe:
+            exec:
+              command:
+                - sh
+                - -c
+                - pg_isready -d "$POSTGRES_DB" -U "$POSTGRES_USER"
+            initialDelaySeconds: 30
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            exec:
+              command:
+                - sh
+                - -c
+                - pg_isready -d "$POSTGRES_DB" -U "$POSTGRES_USER"
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
           volumeMounts:
             - mountPath: "/var/lib/postgresql/data"
               name: db-data