refactor(teamspeak-server): ambientMesh becomes an object carrying Istio's two constants

Gitea #143, maintainer's instruction. The HBONE port and the redirected probe
source are ISTIO CONSTANTS, not standards, so they move from template literals
into values with documented defaults - an operator can then correct them when
Istio changes a number, without waiting for a chart release.

One object under one "enabled", so the two halves still cannot be set
separately; two values could drift apart, which is what this design exists to
prevent. Every read is null-safe (#99), so a deleted object or one carrying
only "enabled: true" falls back to the defaults declared here rather than
dereferencing nil - the defect #136 shipped one value away.

Provenance now written on each constant: 15008 is Istio's HBONE port, not
IANA-registered for this and unknown to Kubernetes; 169.254.7.127 is link-local
(RFC 3927, never routed), its IPv6 counterpart carries the same digits plus
1337, and neither the NetworkPolicy API nor the kubelet knows the address -
only Istio's data plane rewrites the probe source onto it. Both read for
ztunnel 1.30.6, and a change in either fails silently.

The exception in ci/run-networkpolicy-test.sh stays pinned to the numbers that
test names, and additionally asserts this chart declares the same defaults -
never "whatever the value says", which would let a mistyped port in through a
configurable field.

No version change: nothing is published yet, the default is still off, and the
render at defaults is byte-identical - re-diffed against origin/main.

No redirectedProbeSources here, in neither values.yaml nor the schema: this
chart offers no networkPolicy.probeSources, so its probe rule is never
source-restricted and no ipBlock is ever rendered. The key would reach no rule
and read as a control that does nothing, which is worse than one that is
absent. ci/run-networkpolicy-test.sh asserts that absence rather than
tolerating it.

teamspeak-server/templates/teamspeak-server.networkpolicy.yaml

@@ -54,7 +54,15 @@ selects.
        thing as the top-level .Values.ingress (the Ingress object) - both match
        a search for "ingress". */}}
 {{- $npIngress := $np.ingress | default dict }}
-{{- $ambientMesh := $npIngress.ambientMesh }}
+{{- /* NULL-SAFE ON PURPOSE (#99): ambientMesh is an OBJECT, so every read goes
+       through a fallback reproducing THIS chart's declared defaults. An
+       operator who deletes the object, or writes only "enabled: true", must
+       land on the defaults and not in a nil dereference - #136 shipped exactly
+       that defect one value away, where the NOTES.txt branch dereferenced
+       .networkPolicy.egress directly. */}}
+{{- $ambient := $npIngress.ambientMesh | default dict }}
+{{- $ambientEnabled := $ambient.enabled }}
+{{- $ambientPort := $ambient.port | default 15008 }}
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
@@ -101,7 +109,7 @@ spec:
     - ports:
         - protocol: TCP
           port: {{ .Values.server.fileTransferPort | int64 }}
-        {{- if $ambientMesh }}
+        {{- if $ambientEnabled }}
         {{- /* networkPolicy.ingress.ambientMesh (Gitea #143). 15008/TCP is ztunnel's
                HBONE tunnel, the port every inbound connection arrives on once the
                namespace carries istio.io/dataplane-mode - ambient "does not and will
@@ -128,11 +136,22 @@ spec:
                OR over its rules, so which rule carries the port decides only which
                sources reach it - and an open TCP rule is the honest default while it
                is unknown where ztunnel dials from.
+               AN ISTIO CONSTANT, NOT A STANDARD: 15008 is not registered with
+               IANA for this, no protocol prescribes it, and Kubernetes knows
+               nothing about it - Istio picked it for HBONE and Istio can change
+               it. Hence a VALUE with a documented default rather than a literal
+               here, so an operator can correct it without a chart release. Read
+               for ztunnel 1.30.6. The exception ci/run-networkpolicy-test.sh
+               grants is pinned to the number THAT TEST names, plus a check that
+               this chart declares the same default - never to whatever the value
+               says, because that would let a mistyped port ride in through a
+               configurable field (design A of #143).
+
                NOT MEASURED: that 15008 alone suffices comes from Istio's
                documentation. Measured on this cluster is only which listeners ztunnel
                opens. Provable at the first namespace to join the mesh; none has. */}}
         - protocol: TCP
-          port: 15008
+          port: {{ int $ambientPort }}
         {{- end }}
     {{- /*
     THE WEB QUERY INTERFACE, and the one rule in this chart with real security