fix(docs): close the remaining placeholder-secret and egress gaps

Review found the Terraform snippet still inherited one placeholder it did not
override: values-aws.yaml sets postgresql.auth.password to
your-secure-postgres-password, and the chart accepts it. Same class as the app
secrets, same consequence — a bundled database with a publicly documented
credential.

The AWS and GCP example values also enable networkPolicy, whose default egress
reaches only the bundled pods and TCP 443. The page told operators to replace
Postgres and Redis with managed instances without saying that leaves them
unreachable until the egress rules open a path.

Pi has its own immutable image and fails closed without it; the Function image
cannot satisfy that requirement, so it gets its own row rather than being folded
into the sandbox one.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015BwsJTEQRzWJaY4BRCkPZt

Author: waleedlatif1

apps/docs/content/docs/platform/self-hosting/reference-architectures.mdx

@@ -26,10 +26,15 @@ Everything the chart can run itself, it runs by default. That is convenient for
 | Ingress | Off | You install the controller; the chart renders the Ingress |
 | TLS certificates | Off | You provision them |
 | Remote sandbox | Off | Required for Python, Shell, and imported JavaScript — a provider **and** an immutable Function image. See [Security](/platform/self-hosting/security) |
+| Pi execution | Off | A separate immutable image from the Function one, pinned with `E2B_PI_TEMPLATE_ID` or `DAYTONA_PI_SNAPSHOT_ID`. Fails closed without it |
 | PII redaction, Ollama, telemetry collector | Off | Optional, off unless you enable them |
 
 The bundled Postgres uses a 10 Gi `ReadWriteOnce` volume and is intended for evaluation. Moving to managed Postgres is the single most important production change.
 
+<Callout type="warn">
+  The AWS and GCP example values set `networkPolicy.enabled: true`, and the chart's default egress allows only the bundled pods and TCP 443. Moving Postgres or Redis outside the cluster without opening a path leaves them unreachable — add the rules to `networkPolicy.egress`, or set `networkPolicy.allowExternalEgress: true`, in the same change that points the app at the managed instance.
+</Callout>
+
 ## Sizing
 
 | Component | Requests | Limits |
@@ -154,12 +159,15 @@ resource "helm_release" "sim" {
     { name = "app.env.API_ENCRYPTION_KEY", value = var.api_encryption_key },
     { name = "app.env.INTERNAL_API_SECRET", value = var.internal_api_secret },
     { name = "app.env.CRON_SECRET", value = var.cron_secret },
+    # Only when the bundled Postgres is in use. With managed Postgres, set
+    # externalDatabase.* and postgresql.enabled=false instead.
+    { name = "postgresql.auth.password", value = var.postgres_password },
   ]
 }
 ```
 
 <Callout type="warn">
-  The example values files ship literal placeholders such as `your-secure-production-auth-secret-here`. The chart only rejects empty values and its own `CHANGE-ME` strings, so a deployment that inherits those placeholders installs cleanly with a publicly known session-signing secret. Override every secret, or use External Secrets and set none of them inline.
+  The example values files ship literal placeholders such as `your-secure-production-auth-secret-here`. That includes `postgresql.auth.password`. The chart only rejects empty values and its own `CHANGE-ME` strings, so a deployment that inherits those placeholders installs cleanly with a publicly known session-signing secret and database password. Override every secret, or use External Secrets and set none of them inline.
 </Callout>
 
 Because the chart is local, `version` does nothing — what pins it is the git ref you vendor from, and `helm/sim/Chart.yaml` tells you which chart release that ref carries. Pin that ref, and pin the image tags separately, or an unplanned `terraform apply` can move Sim to a new release with new migrations. See [Upgrades](/platform/self-hosting/upgrades).