vad: contracts DB_URL from the Vault postgres secret (external database)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/contracts/vad/backend.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: contracts
+  namespace: contracts
+spec:
+  values:
+    services:
+      contracts:
+        podAnnotations:
+          _default:
+            vault.hashicorp.com/agent-inject-template-contracts-db: |-
+              {{- with secret "secrets/data/apps/contracts/postgres" -}}
+              DB_URL=postgresql://{{ index .Data.data "username" }}:{{ index .Data.data "password" }}@{{ index .Data.data "host" }}:{{ index .Data.data "port" }}/{{ index .Data.data "database" }}?sslmode=disable
+              {{- end -}}

apps/contracts/vad/kustomization.yaml

@@ -2,3 +2,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ../base
+patches:
+  - path: backend.yaml
+    target:
+      kind: HelmRelease
+      name: contracts