fix(dtrack): source DB password from externalDatabase.existingSecret

[dragonpaw]

Summary

When postgres.enabled=false and externalDatabase.existingSecret is set, templates/secrets.yaml intentionally skips writing POSTGRES_PASSWORD into the chart-managed Secret (the operator owns the credential). dtrack, however, always referenced <release>-secrets:POSTGRES_PASSWORD, so the pod fails to start with CreateContainerConfigError because the key it points at does not exist.

This PR makes dtrack source ALPINE_DATABASE_PASSWORD from the operator-provided externalDatabase.existingSecret in that branch, using a new externalDatabase.existingPasswordKey value (default "POSTGRES_PASSWORD"). All other paths (in-cluster postgres, or external DB with inline password) keep their previous source, so the change is backwards compatible — helm template output is byte-identical for those cases.

Reproducer (before this PR):

helm template ak charts/artifact-keeper \
  --set postgres.enabled=false \
  --set externalDatabase.existingSecret=mysecret \
  --set externalDatabase.host=h --set externalDatabase.port=5432 --set externalDatabase.username=u \
  --set secrets.jwtSecret=jwt --set secrets.s3AccessKey=ak --set secrets.s3SecretKey=sk \
  --set opensearch.auth.password=op \
  --set dependencyTrack.enabled=true --set dependencyTrack.adminPassword=adminpw

The rendered dtrack pod env points at ak-artifact-keeper-secrets:POSTGRES_PASSWORD, but the rendered Secret has no such key.

Test Checklist

• Helm template renders without errors (helm lint clean)
• Terraform validates/plans cleanly (N/A — chart-only change)
• Manually verified on staging cluster (CloudSQL + GKE)
• Rollback strategy documented (pure additive value; revert is safe)

Infrastructure

• Helm: helm template renders correctly across four value combinations (defaults; external DB inline password; external DB existingSecret; external DB existingSecret + custom existingPasswordKey)
• Terraform: terraform validate passes (N/A)
• Terraform: terraform plan shows expected changes (N/A)
• ArgoCD: Application manifests are valid (N/A)
• N/A - documentation only

---

Closes #150

[brandonrc]

Thanks for this. Now that several chart PRs (including the v1.2.0 alignment #145 and the load-bearing image-tag change #78) have landed on main, this branch has merge conflicts. Could you rebase onto the latest main, resolve them, run cd charts/artifact-keeper && helm-docs if values changed, and push? CI will re-run after.

(The red SonarCloud check is a known non-blocking fork limitation and can be ignored.)

[dragonpaw]

Rebased onto the latest main as requested — the conflicts are resolved and helm-docs (v1.14.2) was regenerated for the new externalDatabase.existingPasswordKey value. Also filed and linked a tracking issue (#150, Closes #150 footer) so the require-linked-issue check is green. helm lint/helm template clean. Ready for another look.