[Story] SPIRE server topology design

[shreyanshjain7174]

Parent

Part of #146 (Cross-Cluster Agent Identity Federation epic).

Status

Blocked by validation gate (#0). Do not start until that story is closed as completed.

Goal

Design the SPIRE server deployment topology for NineVigil: one trust domain per cluster, federation between SPIRE servers, optional bundled sub-chart or BYO.

Scope

• Decision: bundle SPIRE as a Helm sub-chart (opt-in, enabled: false default) vs BYO documentation only
• Reference deployment diagrams for: single cluster, 2-cluster federation, air-gapped 2-cluster
• Define trust domain naming convention (e.g. ninevigil-<cluster-name>.<base-domain>)
• SPIRE server HA topology recommendation (replicas, datastore: in-memory vs SQLite vs PostgreSQL)
• CA strategy: self-signed (default), cert-manager-integrated, external CA (KMS/HSM)
• SPIRE agent placement: DaemonSet on all nodes vs labeled nodes only
• Federation modes: connected (Federation API) and air-gapped (manual bundle exchange)

Output

• ADR (architecture decision record) in docs/architecture/adrs/
• Updated RFC-0001 § 4.1 + § 4.5 with finalized choices
• Helm values.yaml schema preview

Acceptance

• ADR merged, RFC updated, no open questions in the topology section