SmallWorlds v1.2.41

Everything here was found by running the system end to end on a real LAN
deployment rather than by reading it. Each fix is on a path this project's own
documentation recommends, and none would have shown up in a code review.

Read before adopting

The database backup chain no longer uses CloudNativePG's in-tree Barman Cloud
support, which is deprecated in CNPG 1.30 and removed entirely in 1.31.0.
Before this release, a routine operator upgrade would have deleted both the
production of database Recovery Points and the ability to read the ones already
written — and because a cluster whose backups have stopped looks exactly like one
whose backups work, it would have surfaced during a restore.

Each database now declares an ObjectStore (barmancloud.cnpg.io/v1) and
references it from spec.plugins; the plugin itself installs at sync wave −10/−9
and needs cert-manager, which is already present. destinationPath and
serverName are unchanged, so archives written by the previous release remain
readable — verified by restoring from them through the plugin.

Two things to expect when you adopt it:

• A short WAL archiving gap at cutover. Between the in-tree archiver being
  removed and the plugin taking over, a few pg_stat_archiver failures on one
  segment are normal; the next segment archives cleanly. Four were observed here.
• serverName moves to the Cluster. The plugin's webhook forbids it on the
  ObjectStore — worth knowing if you carry local patches, because the upstream
  migration guide tells you to copy the in-tree block wholesale, and that puts
  the field in the one place it is not allowed.

See docs/adr/0050.

Fixes for things that could not work at all

• pod-gateway could never be selected. Its id contains a hyphen, so
  prepare-community-repo.sh aborted under set -e when it reached that app —
  after creating the GitHub repository and before writing a single overlay file.
  The one optional application the pod archive needs was unreachable through the
  supported path.
• POD_DATA_DIR never worked on a device. ReadWritePaths is a list, so the
  drop-in appended to it instead of replacing it and the unit kept a directory a
  custom-data-dir install never creates; systemd killed the service with
  226/NAMESPACE before the agent ran. This is the documented way to put a
  member's archive on an external disk, which is the normal case.
• First-boot certificate race. The bootstrap waited for cert-manager's CRD to
  be Established and then applied the ClusterIssuer immediately — but the
  validating webhook is a separate Deployment, and a single apply lost that race
  on a cold node. The result was not a missing object but a cluster where nothing
  would ever get a certificate, and an install that stopped before collecting the
  kubeconfig. Both bootstraps now retry until their existing deadline.

Restore procedures, corrected and drilled

doc/storage-and-backup.md §7.1 could not have worked as written: it pointed at
the operational Garage rather than garage-backup, omitted the signing region
without which Garage answers HTTP 400, and described the credential trap
backwards. All three are fixed, and §7.1, §7.2 (Velero) and §7.4 (Immich
originals from the pod archive) now carry the results of having actually been
run — including a database recovered with zero data loss across an hour of WAL
replay, and a deleted original restored with a byte-identical digest.

§7.2 also no longer assumes the velero CLI, which is precisely what a rebuilt
operator laptop will not have.

Full Changelog: v1.2.40...v1.2.41