Add PodDisruptionBudgets for multi-replica user-facing services

[kelchm]

Summary

The tree has zero PodDisruptionBudgets. Voluntary disruptions are rare by design — AGENTS.md mandates one-node-at-a-time operations with full health restored between nodes, and kanidm carries a hostname topologySpreadConstraint (kubernetes/apps/identity/kanidm/app/kanidm.yaml:63). But PDBs protect against the uncontrolled case: operator error during a degraded cluster, an unexpected eviction wave, or a drain mistake while replicas are already down. Today nothing prevents evicting the last replica of kanidm (the OIDC source of truth), all three traefik instances, or coredns.

Proposed work

• PDBs with minAvailable: 1 for: kanidm (3 replicas), each traefik instance (2 replicas each), coredns (2 replicas).
• Document policy for singleton stateful workloads (Loki, VictoriaLogs, CNPG clusters): a maxUnavailable: 1 PDB on a single replica is a no-op, so the honest answer is likely "documented singletons, PDB out of scope" unless those scale up.

Acceptance criteria

• PDBs exist for kanidm, all three traefik instances, and coredns.
• A one-node drain test preserves at least one replica of each.
• Singleton policy documented (PDB or explicit rationale).

Related

• Tune failover timing — k8s defaults give 5m 40s recovery, too slow for homelab LAN #3 (failover timing — disruption behavior interacts with recovery expectations)