The cost-onprem Helm chart currently deploys its own PostgreSQL, Valkey, and
relies on the install script to deploy Kafka (via Strimzi). These bundled
deployments are suitable for development, testing, and non-production
environments but are NOT appropriate for production, where customers will
typically have their own managed or enterprise-grade infrastructure.

This epic adds first-class support for connecting to externally-managed
services, allowing customers to "bring their own infrastructure" (BYOI) for:

• PostgreSQL — Use an existing enterprise database (e.g., Crunchy, EDB,
  RDS, Azure Database for PostgreSQL). Skip deploying the bundled StatefulSet.
• Valkey/Redis — Use an existing Redis-compatible cache (e.g., Redis
  Enterprise, ElastiCache, Azure Cache). Skip deploying the bundled
  Deployment.
• Kafka — Use an existing Kafka broker (e.g., AMQ Streams, Confluent,
  MSK) with full SASL/TLS authentication support. Skip Strimzi deployment.
• Keycloak — Connect to a customer-managed Keycloak/RHBK instance with
  clear documentation for required realm/client configuration.

Acceptance Criteria (Epic-level):

• For each service, a boolean flag (e.g., `database.deploy: false`) skips
  the internal deployment while still configuring connection strings
• External connection parameters (host, port, credentials secret, TLS) are
  fully configurable via values.yaml
• Init containers (waitForDb, waitForKafka, etc.) adapt to external
  endpoints rather than always targeting internal service names
• install-helm-chart.sh respects external mode and skips provisioning steps
• Documentation covers required external service configuration
  (schema setup, Keycloak client/realm, Kafka topics, etc.)
• Existing CI/dev workflow (bundled services) continues to work unchanged

Business Value:
Production deployments require enterprise-grade infrastructure with HA,
backup, monitoring, and compliance controls that a bundled single-replica
StatefulSet cannot provide. This epic removes the barrier to production
adoption by decoupling the application from its infrastructure dependencies.