seaweedfs (tenant module): data PVCs and certificate/db secrets orphaned after the module is disabled #3092

Describe the bug

After enabling and then disabling the seaweedfs tenant module, the SeaweedFS data PVCs and a set of certificate/credential secrets are left orphaned in the tenant namespace.

Environment

• Cozystack: dev9 (config version 45, charts @ fe13212a10a6)
• Provider: on-prem (bare-metal)

To Reproduce

1. Create a tenant with seaweedfs: true; wait until Ready.
2. Set seaweedfs: false; wait ~120s (the seaweedfs/seaweedfs-db/seaweedfs-system HelmReleases are removed cleanly).
3. kubectl -n <tenant-ns> get pvc,secret | grep seaweedfs — PVCs and secrets remain.

Expected behaviour
No orphaned PVCs/secrets remain after the seaweedfs module is disabled.

Actual behaviour

pvc/data1-seaweedfs-system-volume-0
pvc/data1-seaweedfs-system-volume-1
secret/seaweedfs-system-admin-cert
secret/seaweedfs-system-ca-cert
secret/seaweedfs-system-client-cert
secret/seaweedfs-system-filer-cert
secret/seaweedfs-system-master-cert
secret/seaweedfs-system-volume-cert
secret/seaweedfs-system-worker-cert
secret/seaweedfs-s3-ingress-tls
secret/seaweedfs-system-db-secret

Additional context

• Root cause: The seaweedfs HelmReleases delete cleanly, but the StatefulSet volumeClaimTemplates (data1-seaweedfs-system-volume-*) are never garbage-collected on StatefulSet deletion (no persistentVolumeClaimRetentionPolicy/cleanup). The component certificate secrets (seaweedfs-system-*-cert), the S3 ingress TLS secret (seaweedfs-s3-ingress-tls), and the DB credentials secret (seaweedfs-system-db-secret) are not owner-referenced and orphan.
• Proposed fix: Add a release-scoped post-delete PVC cleanup hook for the SeaweedFS data PVCs, plus cleanup (or ownerReferences) for the orphaned certificate/credential secrets.

Found during a create→delete leak sweep of packages/extra tenant modules on Cozystack dev9 (toggle module on → off; the tenant namespace persists). Companion to the apps sweep (#3056–#3062).