feat: publish post trending events

[vpol]

Summary

• add a typed api.v1.post-trending Pub/Sub event
• emit it from the primary CDC worker when post.trending changes from nullish to a positive number
• include trendingAt as an ISO timestamp derived from the row after-image lastTrending value
• cover the CDC behavior and payload shape in the primary worker test

Impact

Consumers can subscribe to a dedicated trending-post signal instead of inferring trendiness from visibility or generic content updates. The event now carries when the post became trending, matching the lastTrending timestamp written by the trendiness recalculation job.

Validation

• pnpm exec prettier --write src/common/typedPubsub.ts src/workers/cdc/primary.ts __tests__/workers/cdc/primary.ts
• pnpm exec tsc --noEmit
• attempted pnpm exec jest __tests__/workers/cdc/primary.ts --runInBand, blocked locally by Postgres auth: password authentication failed for user "postgres"

[pulumi]

🍹 The Update (preview) for dailydotdev/api/prod (at 0a8a2c6) was successful.

✨ Neo Explanation

This deployment ships a new post-trending CDC event, removes the Flyting/live-room feature (ingress, subscriptions, secrets), and consolidates Apple auth from a K8s secret volume to a config-only entry — with the main risk being potential message loss in the deleted PubSub subscriptions, particularly `user-deletion-cleanup`. 🟡 Moderate Risk

This deployment bundles several distinct changes: the PR's new api.v1.post-trending CDC event, removal of the Flyting/live-room feature set, a Kubernetes secret restructuring, and a standard image rollout to the new commit SHA.

What's driving the broad changes:

The code diff only shows the trending event addition, but the infrastructure reflects a larger cleanup effort happening in the same commit:

• Flyting/live-room teardown: The ingress rule for /flyting/ws is removed (traffic will no longer route to the flyting-public backend), multiple PubSub subscriptions on flyting.v1.* topics are deleted, and FLYTING_INTERNAL_KEY, FLYTING_JOIN_TOKEN_SECRET, FLYTING_ORIGIN are being stripped from the cluster secret.
• Volume consolidation: All deployments and cron jobs are removing the apple-auth K8s secret volume (mounted at /opt/app/apple) and replacing it with the geoip-data GCS CSI volume in that same slot. The standalone vpc-native-apple-auth-secret K8s Secret is also being deleted.
• K8s secret restructuring: vpc-native-k8s-secret is being replaced (not just updated) — removing APPLE_KEY_ID, APPLE_SIGNING_KEY_PATH, APPLE_TEAM_ID, RECSWIPE_ORIGIN, SNOTRA_USER_API_ORIGIN and the Flyting keys, while adding APPLE_CLIENT_SECRET. Since this is a create-replacement (+-), the new secret is created before the old is deleted, which is safe for rolling deployments.

---

🟡 Warning — PubSub subscription deletions with potential message loss: The user-deletion-cleanup subscription (topic: user-deletion-requested) and the major-headline-added-notification / new-highlight-real-time subscriptions (topic: post-highlighted) are being permanently deleted. Any unacknowledged messages queued in these subscriptions at the time of deletion will be permanently discarded. Confirm there are no in-flight user deletion events or highlight notifications that need draining before removal.

🟡 Warning — Ingress backend swap: The subs ingress is consolidating from two path rules (/flyting/ws → flyting-public, /* → [secret]-subs) to a single /* rule pointing to [secret]-subs. Any active Flyting WebSocket connections will be terminated at the time this Ingress update is applied.

🔵 Info — New api.v1.post-trending PubSub topic: Added to the schema but no new subscription is provisioned in this stack. The topic must already exist or be consumed by a downstream service — verify the consumer is deployed and ready to handle these new events before or alongside this rollout.

Resource Changes

    Name                                                       Type                                  Operation
~   vpc-native-update-tags-str-cron                            kubernetes:batch/v1:CronJob           update
~   vpc-native-post-analytics-clickhouse-cron                  kubernetes:batch/v1:CronJob           update
+   api-sub-api.agentic-digest-tweet                           gcp:pubsub/subscription:Subscription  create
~   vpc-native-channel-highlights-cron                         kubernetes:batch/v1:CronJob           update
~   vpc-native-worker-job-deployment                           kubernetes:apps/v1:Deployment         update
~   vpc-native-temporal-deployment                             kubernetes:apps/v1:Deployment         update
-   api-sub-api.live-room-starting-soon-notification           gcp:pubsub/subscription:Subscription  delete
~   vpc-native-update-source-public-threshold-cron             kubernetes:batch/v1:CronJob           update
~   vpc-native-update-current-streak-cron                      kubernetes:batch/v1:CronJob           update
~   vpc-native-clean-zombie-user-companies-cron                kubernetes:batch/v1:CronJob           update
~   vpc-native-clean-expired-better-auth-sessions-cron         kubernetes:batch/v1:CronJob           update
~   vpc-native-squad-posts-analytics-refresh-cron              kubernetes:batch/v1:CronJob           update
~   vpc-native-check-analytics-report-cron                     kubernetes:batch/v1:CronJob           update
~   vpc-native-personalized-digest-cron                        kubernetes:batch/v1:CronJob           update
-   api-sub-api.live-room-started                              gcp:pubsub/subscription:Subscription  delete
~   vpc-native-update-achievement-rarity-cron                  kubernetes:batch/v1:CronJob           update
-   api-sub-api.live-room-ended                                gcp:pubsub/subscription:Subscription  delete
~   vpc-native-clean-stale-user-transactions-cron              kubernetes:batch/v1:CronJob           update
~   vpc-native-update-views-cron                               kubernetes:batch/v1:CronJob           update
~   vpc-native-private-deployment                              kubernetes:apps/v1:Deployment         update
~   vpc-native-generate-search-invites-cron                    kubernetes:batch/v1:CronJob           update
~   vpc-native-user-profile-analytics-clickhouse-cron          kubernetes:batch/v1:CronJob           update
~   vpc-native-user-profile-updated-sync-cron                  kubernetes:batch/v1:CronJob           update
-   vpc-native-api-db-migration-0b3b0a7d                       kubernetes:batch/v1:Job               delete
+-  vpc-native-k8s-secret                                      kubernetes:core/v1:Secret             create-replacement
~   vpc-native-daily-digest-cron                               kubernetes:batch/v1:CronJob           update
~   vpc-native-calculate-top-readers-cron                      kubernetes:batch/v1:CronJob           update
~   vpc-native-channel-digests-cron                            kubernetes:batch/v1:CronJob           update
~   vpc-native-clean-gifted-plus-cron                          kubernetes:batch/v1:CronJob           update
~   vpc-native-materialize-monthly-best-post-archives-cron     kubernetes:batch/v1:CronJob           update
~   vpc-native-ws-deployment                                   kubernetes:apps/v1:Deployment         update
~   vpc-native-validate-active-users-cron                      kubernetes:batch/v1:CronJob           update
~   vpc-native-user-profile-analytics-history-clickhouse-cron  kubernetes:batch/v1:CronJob           update
~   vpc-native-expire-super-agent-trial-cron                   kubernetes:batch/v1:CronJob           update
-   vpc-native-api-clickhouse-migration-0b3b0a7d               kubernetes:batch/v1:Job               delete
-   api-sub-api.user-deletion-cleanup                          gcp:pubsub/subscription:Subscription  delete
~   vpc-native-deployment                                      kubernetes:apps/v1:Deployment         update
~   vpc-native-bg-deployment                                   kubernetes:apps/v1:Deployment         update
-   api-sub-api.new-highlight-real-time                        gcp:pubsub/subscription:Subscription  delete
~   vpc-native-generic-referral-reminder-cron                  kubernetes:batch/v1:CronJob           update
+   vpc-native-api-clickhouse-migration-d612e808               kubernetes:batch/v1:Job               create
... and 21 other changes