Project catalog ownership

Catalog	Ownership
`apps/auth-server`	API workload와 lab ingress
`apps/identity-postgres`	auth platform 전용 PostgreSQL
`apps/auth-migration`	versioned Flyway migration Job
`apps/keycloak-realm-import`	versioned realm/client import
`platform/forward-auth`	oauth2-proxy와 Traefik ForwardAuth component
`platform/keycloak`	Keycloak instance와 ingress
`platform/minio`	MinIO Tenant
`platform/registry`	Docker registry
`platform/vault`	Vault workload
`platform/secret-delivery`	VSO auth/connection, Helm values와 VaultStaticSecret
`platform/*-operator`	cluster-scoped controller source와 environment patch
`policies/baseline`	namespace 보안 baseline
`tenants/mnt`	`mnt` namespace 경계

Catalog는 직접 controller root로 지정하지 않습니다. 실제 환경은 gitops/clusters/<...> 아래 entrypoint에서 필요한 catalog만 선택합니다.