[marcleblanc2]

Closes #388

Checklist

• Follow the manual testing process
• Update changelog
• Update Kubernetes update doc (not needed: opt-in, no upgrade action)

What

Adds <database>.postgresExporter.standalone (default false) for pgsql, codeIntelDB and codeInsightsDB. When a database is external (<database>.enabled: false) and the toggle is set, the chart deploys pgsql-exporter as its own Deployment + Service, so the Postgres panels in the Grafana dashboards work against managed databases such as AWS RDS.

pgsql:
  enabled: false
  auth:
    host: pgsql.abc.us-east-1.rds.amazonaws.com
    sslmode: require
  postgresExporter:
    standalone: true

• sourcegraph.dataSource now builds DATA_SOURCE_URI from the auth secret's host and sslmode keys when the database is external. The sidecar on internal databases still renders localhost:...?sslmode=disable, unchanged.
• The Service carries app: <database name>, which the Prometheus relabel config maps to the job label the dashboards group by (job="codeinsights-db" is matched literally in the dashboard queries).
• The Deployment reuses the database's podSecurityContext, nodeSelector, affinity, tolerations, priorityClassName, serviceAccount, podLabels/podAnnotations and postgresExporter.env, plus the global postgresExporter.image / resources.
• When sourcegraph.disableKubernetesSecrets is true, no DATA_SOURCE_* env is rendered; supply the DSN via postgresExporter.env.
• The external-databases example README listed the secret key as pgsslmode; the chart reads sslmode (already required by the application containers), so it's corrected.

Test plan

• helm lint charts/sourcegraph/: clean
• helm unittest charts/sourcegraph: 202 passed, including new tests/postgresExporterStandalone_test.yaml (no render by default, no render for internal DB with toggle on, no render for external DB with toggle off, one Deployment+Service per enabled DB, env wiring with existingSecret, Service labels/annotations, sidecar DSN unchanged)
• helm template with default values diffed against origin/main: identical
• helm template with all three databases external and standalone: true: three Deployments and Services render as expected (see charts/sourcegraph/examples/external-databases/override.yaml)
• ./scripts/helm-docs.sh: README regenerated, tree clean

[github-actions]

Open the Diff Tour for this PR in Sourcegraph