Paperless-ngx chart: naming scheme, secret refs, pinned init images (conventions batch 3)

Batch-3 major PR for paperless-ngx (issue #32):

- secrets.redisRef/databaseRef/paperlessRef -> redisSecretRef/
  databaseSecretRef/paperlessSecretRef (consistent with the other
  SecretRef values in the same block); CI fixtures updated
- TLS secret renamed to the standard tls-<release>-<chart>-ingress
  (domain no longer part of the name)
- busybox init/cronjob image pinned via paperless.busybox.image
  values, default bumped 1.28 -> 1.38.0
- probes values-configurable (defaults unchanged, incl. the 600s
  startup budget); consume CronJob deliberately stays probe-less
- ingress standard: ingress.className (default nginx) and
  ingress.annotations merge; domain/clusterIssuer stay required
- additive paperless.env block rendered through tpl (value,
  secretKeyRef, configMapKeyRef forms)
- disabled scripts ConfigMap renamed to ...-configmap; PVC names kept
  as documented naming-scheme exception (comments in the templates)
- chart 8.0.1+up3.0.5 -> 9.0.0+up3.0.5 (breaking values changes)

paperless-ngx/values.yaml

@@ -5,20 +5,31 @@
 scaleDown: false
 
 secrets:
-  redisRef: null
-  databaseRef: null
-  paperlessRef: null
+  redisSecretRef: null
+  databaseSecretRef: null
+  paperlessSecretRef: null
   smbConnectionSecretRef: null
   oidcSecretRef: null
 
 ingress:
   clusterIssuer: "letsencrypt-issuer"
   domain: null
+  className: nginx
+  # Extra annotations for the Ingress; merged with the cert-manager
+  # cluster-issuer and upload-size annotations the chart always sets.
+  annotations: {}
 
 paperless:
   # Replica count for this workload; 0 is allowed and scales it down.
   # The chart-global scaleDown flag takes precedence.
   replicas: 1
+  # Auxiliary busybox image, used by the /run-ownership init container and the
+  # SMB consume-mover CronJob. Pinned independently of appVersion (which
+  # tracks paperless-ngx); reviewed alongside every app-version update round.
+  busybox:
+    image:
+      repository: busybox
+      tag: "1.38.0"
   ocr:
     languages: "eng"
     # Paperless-ngx 3.x modes: auto (default, skips OCR when embedded text
@@ -53,6 +64,37 @@ paperless:
   scripts:
     postConsumptionScripts: []
     preConsumptionScripts: []
+  livenessProbe:
+    httpGet:
+      path: /
+      port: 8000
+    periodSeconds: 30
+    failureThreshold: 3
+    successThreshold: 1
+    timeoutSeconds: 5
+  readinessProbe:
+    httpGet:
+      path: /
+      port: 8000
+    periodSeconds: 10
+    failureThreshold: 3
+    successThreshold: 1
+    timeoutSeconds: 5
+  # The startup probe gates liveness/readiness. Paperless runs database
+  # migrations on startup, and since 3.0 the first start after an upgrade
+  # also rebuilds the search index from scratch (Whoosh -> Tantivy):
+  # budget 10s * 60 = 600s.
+  startupProbe:
+    httpGet:
+      path: /
+      port: 8000
+    periodSeconds: 10
+    failureThreshold: 60
+    timeoutSeconds: 5
+  # Extra environment variables, appended to the ones the chart always sets.
+  # Values are rendered through tpl; value, secretKeyRef and configMapKeyRef
+  # forms are supported.
+  env: []
   resources:
     # Limits are optional: memory and ephemeral-storage limits default to
     # limitFactor x the request, an explicitly set limit always wins, and a