satisfactory chart: naming scheme, security hardening, configurable probes

All audit findings from #32 for the satisfactory chart in one major PR:

- StatefulSet renamed to {{ .Release.Name }}-{{ .Chart.Name }}-sfs, service
  to ...-service (standard scheme); template file satisfactory-server.sfs.yaml
  renamed to satisfactory.sfs.yaml. The PVC keeps its historical -vc name
  (documented naming exception; renaming would orphan the data).
- Hardened, values-configurable security contexts (securityContext.pod /
  securityContext.container): runAsNonRoot with the image's steam user
  (uid/gid 1000), readOnlyRootFilesystem, all capabilities dropped. emptyDirs
  mounted at /tmp and the steam user's ~/.steam, ~/.config and ~/.local make
  the read-only root filesystem work; all other writes go to the PVC.
- Probes are now values (livenessProbe/readinessProbe/startupProbe), defaults
  exactly the previously hardcoded values.
- Additive env value rendered through tpl with value/secretKeyRef/
  configMapKeyRef forms (template-chart pattern).

Chart 3.1.1+upv1.9.10 -> 4.0.0+upv1.9.10 (major: resource renames +
hardening); appVersion unchanged.

satisfactory/templates/satisfactory.service.yaml

@@ -1,9 +1,9 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: "{{ .Release.Name }}-{{ .Chart.Name }}-sf-service"
+  name: {{ .Release.Name }}-{{ .Chart.Name }}-service
   labels:
-    app: "{{ .Release.Name }}-{{ .Chart.Name }}-sf-service"
+    app: {{ .Release.Name }}-{{ .Chart.Name }}-service
 spec:
   type: NodePort
   ports:
@@ -23,4 +23,4 @@ spec:
       nodePort: {{ .Values.server.messagingPort }}
       targetPort: {{ .Values.server.messagingPort }}
   selector:
-    app: "{{ .Release.Name }}-{{ .Chart.Name }}-sf-server"
+    app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs