chore(storage): remove democratic-csi leftovers

[surrealwolf]

Summary

democratic-csi is fully retired. Verified on all four clusters on 2026-10-04: no CSIDriver, StorageClass, PV/PVC, VolumeAttachment, Helm release, namespace, CRD or RBAC object left (manager, nprd-apps, prd-apps, poc-apps). The one orphaned Released PV on nprd-apps (pvc-25d4289c…, old Loki ingester, driver truenas-nfs) was set to Retain and deleted (YAML backed up locally). Its TrueNAS dataset was not touched.

This PR removes the code side:

• terraform/variables.tf: all democratic_csi_* / install_democratic_csi variables
• terraform/main.tf: null_resource.deploy_democratic_csi_{nprd,prd,poc}_apps (count was 0; none are in state, so no plan changes)
• terraform/outputs.tf: democratic_csi_config output (only change on next apply: that output disappears from state)
• terraform/terraform.tfvars.example: democratic block
• scripts/install-democratic-csi.sh, scripts/generate-helm-values-from-tfvars.sh, docs/DEMOCRATIC_CSI_TRUENAS_SETUP.md deleted
• Docs point at TrueNAS CSI (README, ARCHITECTURE, OPS_NOTES, STORAGE_CLASS_DEFAULT, TROUBLESHOOTING, CNPG setup); migration docs marked done
• .gitignore entries for generated democratic values files are kept on purpose so a restored copy can't be committed

The local terraform.tfvars democratic entries were already removed (backup kept, mode 600).

Test plan

• terraform init -backend=false && terraform validate passes
• State checked: no democratic resources; only the output
• No secrets in diff

Made with Cursor

[cursor]

Approved. Cursor Bugbot completed successfully with no findings that require human review, and no approval policy requires additional review. This automation has not posted a prior approval on this PR.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}