postgresql: add replication + patroni Woodpecker secrets to provision-secrets step (ADR-0001 Phase 1)

.woodpecker/deploy.yml

@@ -110,6 +110,10 @@ steps:
         from_secret: postgresql_password
       POSTGRESQL_PGADMIN_PASSWORD:
         from_secret: postgresql_pgadmin_password
+      POSTGRESQL_REPLICATION_PASSWORD:
+        from_secret: postgresql_replication_password
+      POSTGRESQL_PATRONI_PASSWORD:
+        from_secret: postgresql_patroni_password
       PRODUCTIVITY_PAPERLESS_SECRET_KEY:
         from_secret: productivity_paperless_secret_key
       PRODUCTIVITY_DB_PASSWORD:
@@ -195,9 +199,14 @@ steps:
                 create_or_update_secret 'n8n_db_password'     '$${N8N_DB_PASSWORD}'
                 create_or_update_secret 'n8n_encryption_key'  '$${N8N_ENCRYPTION_KEY}'";;
             postgresql)
+              # NOTE: bootstrap-tier stack (manual deploy only via stack-deploy.sh).
+              # Secrets are still auto-provisioned here so they exist on the host
+              # before the manual `stack-deploy.sh postgresql` run picks them up.
               ssh -o StrictHostKeyChecking=no root@$${SWARM_MANAGER_IP} "source /tmp/cs.sh
                 create_or_update_secret 'postgresql_password'             '$${POSTGRESQL_PASSWORD}'
-                create_or_update_secret 'postgresql_pgadmin_password' '$${POSTGRESQL_PGADMIN_PASSWORD}'";;
+                create_or_update_secret 'postgresql_pgadmin_password'     '$${POSTGRESQL_PGADMIN_PASSWORD}'
+                create_or_update_secret 'postgresql_replication_password' '$${POSTGRESQL_REPLICATION_PASSWORD}'
+                create_or_update_secret 'postgresql_patroni_password'     '$${POSTGRESQL_PATRONI_PASSWORD}'";;
             productivity)
               ssh -o StrictHostKeyChecking=no root@$${SWARM_MANAGER_IP} "source /tmp/cs.sh
                 create_or_update_secret 'productivity_paperless_secret_key' '$${PRODUCTIVITY_PAPERLESS_SECRET_KEY}'