feat: AddonClaim + InitContainer wait-for-secret en chart helm

Cierra GOLDEN-PATH-ADDONCLAIM-MISSING (P0 hands-off pipeline).

Cambios:
- helm/APP_NAME/templates/addonclaim.yaml (NEW): hook pre-install/pre-upgrade
  weight -10, SIN delete-policy (sobrevive upgrades, evita disparar finalizer
  cleanup-logical). Gated por .Values.database.enabled (default true).
- helm/APP_NAME/templates/role-db-secret-reader.yaml (NEW): Role + RoleBinding
  weight -7 que permite al SA leer el Secret <release>-db-creds. Lo consume
  el InitContainer wait-for-secret del Job Alembic.
- helm/APP_NAME/templates/job-alembic-upgrade.yaml: gated por
  database.enabled, anade InitContainer wait-for-secret (48x5s=240s) que
  espera a que addon-provisioner publique el Secret tras reconciliar el
  AddonClaim. Absorbe la latencia del @kopf.timer (RECONCILE_INTERVAL 300s
  + initial_delay 60s) sin tocar el operator.
- helm/APP_NAME/values.yaml: bloque database completo (enabled, addonType,
  databaseName, user.permissions, deletionPolicy Retain). Opt-out con
  database.enabled=false + alembic.enabled=false.
- .gitea/workflows/APP_NAME-build.yaml: helm timeout 5m -> 7m (margen para
  reconcile addon-provisioner + StatefulSet ready + DDL Job + Alembic).
- claim-mariadb.yaml (DELETED): obsoleto - estaba en la raiz del template
  y nunca se renderizaba por helm. Reemplazado por addonclaim.yaml dentro
  del chart helm.
- README.md: documenta nueva tabla de hook weights, opt-out database, y
  trade-off del orphan AddonClaim post-uninstall (cleanup explicito).

Decision arquitectural: Opcion D modificada (Opus 4.6 consult).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.gitea/workflows/APP_NAME-build.yaml

@@ -141,7 +141,11 @@ jobs:
             --set tenantId=${TENANT_ID} \
             --set tenantIdNodashes=${TENANT_ID_NODASHES} \
             --set tier=${TENANT_TIER} \
-            --wait --timeout 5m
+            --wait --timeout 7m
+            # 7m absorbe el peor caso del reconcile de addon-provisioner
+            # (RECONCILE_INTERVAL 300s + initial_delay 60s) + StatefulSet MariaDB
+            # ready (~60s) + Job DDL (~10s) + InitContainer wait-for-secret (~5s)
+            # + Alembic upgrade. Ver helm/<APP_NAME>/templates/addonclaim.yaml.
 
       - name: Verificar rollout
         run: |