Bring userdb into k8s

There's an official DigitalOcean operator that can create and manage DO's hosted databases as normal k8s resources.

I think it would be useful to pivot to a userdb instance managed this way, and replace the manually-managed credentials and secrets with automatically provisioned ones.

We currently abuse the userdb database instance for a couple of other purposes (including e.g. the calckey instance) as a cost saving measure.
We'd have to untangle that knot if we try to do this.