Paperless-ngx chart: naming scheme, secret refs, pinned init images (conventions batch 3)

Batch-3 major PR for paperless-ngx (issue #32):

- secrets.redisRef/databaseRef/paperlessRef -> redisSecretRef/
  databaseSecretRef/paperlessSecretRef (consistent with the other
  SecretRef values in the same block); CI fixtures updated
- TLS secret renamed to the standard tls-<release>-<chart>-ingress
  (domain no longer part of the name)
- busybox init/cronjob image pinned via paperless.busybox.image
  values, default bumped 1.28 -> 1.38.0
- probes values-configurable (defaults unchanged, incl. the 600s
  startup budget); consume CronJob deliberately stays probe-less
- ingress standard: ingress.className (default nginx) and
  ingress.annotations merge; domain/clusterIssuer stay required
- additive paperless.env block rendered through tpl (value,
  secretKeyRef, configMapKeyRef forms)
- disabled scripts ConfigMap renamed to ...-configmap; PVC names kept
  as documented naming-scheme exception (comments in the templates)
- chart 8.0.1+up3.0.5 -> 9.0.0+up3.0.5 (breaking values changes)

paperless-ngx/templates/paperless-server.sfs.yaml

@@ -26,7 +26,7 @@ spec:
         # paperless.securityContext in values.yaml) so the main container can
         # run fully hardened (non-root, no privilege escalation).
         - name: init-run-ownership
-          image: busybox:1.28
+          image: "{{ .Values.paperless.busybox.image.repository }}:{{ .Values.paperless.busybox.image.tag }}"
           imagePullPolicy: IfNotPresent
           command:
             - sh
@@ -185,6 +185,26 @@ spec:
             - name: PAPERLESS_DISABLE_REGULAR_LOGIN
               value: "{{ .Values.oidc.disableRegularLogin }}"
             {{- end }}
+            {{- range $value := .Values.paperless.env }}
+            {{- if $value.value }}
+            - name: {{ $value.name }}
+              value: {{ tpl $value.value $ }}
+            {{- else if $value.valueFrom }}
+            {{- if $value.valueFrom.secretKeyRef }}
+            - name: {{ $value.name }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ tpl $value.valueFrom.secretKeyRef.name $ }}
+                  key: {{ tpl $value.valueFrom.secretKeyRef.key $ }}
+            {{- else if $value.valueFrom.configMapKeyRef }}
+            - name: {{ $value.name }}
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ tpl $value.valueFrom.configMapKeyRef.name $ }}
+                  key: {{ tpl $value.valueFrom.configMapKeyRef.key $ }}
+            {{- end }}
+            {{- end }}
+            {{- end }}
           volumeMounts:
             - mountPath: "/usr/src/paperless/data"
               name: "paperless-volume"
@@ -206,32 +226,11 @@ spec:
           resources:
             {{- include "paperless-ngx.resources" .Values.paperless.resources | nindent 12 }}
           readinessProbe:
-            httpGet:
-              path: /
-              port: 8000
-            periodSeconds: 10
-            failureThreshold: 3
-            successThreshold: 1
-            timeoutSeconds: 5
+            {{- toYaml .Values.paperless.readinessProbe | nindent 12 }}
           livenessProbe:
-            httpGet:
-              path: /
-              port: 8000
-            periodSeconds: 30
-            failureThreshold: 3
-            successThreshold: 1
-            timeoutSeconds: 5
-          # The startup probe gates liveness/readiness. Paperless runs database
-          # migrations on startup, and since 3.0 the first start after an
-          # upgrade also rebuilds the search index from scratch (Whoosh ->
-          # Tantivy): budget 10s * 60 = 600s.
+            {{- toYaml .Values.paperless.livenessProbe | nindent 12 }}
           startupProbe:
-            httpGet:
-              path: /
-              port: 8000
-            periodSeconds: 10
-            failureThreshold: 60
-            timeoutSeconds: 5
+            {{- toYaml .Values.paperless.startupProbe | nindent 12 }}
       restartPolicy: Always
       volumes:
         - name: tmp