feat(rss-bridge): Gateway-API as an alternative to the Ingress (last chart)

rss-bridge was the twenty-second and last chart of the Gateway-API sweep:
22 charts carried an Ingress template, 21 an HTTPRoute template, and the
difference was exactly this one. It had been held back as frozen by #51 -
a runner defect, not a property of the chart - and that freeze is lifted.

One HTTPRoute carrying ALL THREE hostnames, because nothing differs per
host: every name serves the same Service at "/", measured on the live
Ingress. spec.hostnames is a list, so one object is the whole answer and a
second would repeat one rule. (Unlike homeassistant, whose paths differ per
host, or matrix-synapse, whose two routes want different backends.)

httpRoute.hostnames is its own MANDATORY value, which is a third shape for
this repository and follows from the values rather than from taste. Most
charts fall back to ingress.domain; freesailarr and homeassistant reject a
hostnames key outright, because a chart-global list could not say which app
or host entry it belonged to. This chart has no ingress.domain either, but
its names are unambiguous - and the ingress.hosts list it would otherwise
reuse carries per-host tlsSecretName values that address nothing once TLS
sits on the Gateway's listener. Reusing it would drag a structure whose
other half is meaningless into the new mode.

rss-bridge.tlsGroups is therefore INERT in Gateway mode, and that is named
as a simplification rather than quietly translated: the helper exists only
to group hosts by TLS secret name, and there is nothing left to group. The
required() on ingress.hosts needed no change to become conditional - it
already sits inside the Ingress template behind ingress.enabled - so what
is new is that values.yaml and the schema now say so.

The ingress.enabled-derived-value screen that caught sure, freesailarr and
ytdlp-web-player was run here and came back CLEAN: outside the Ingress
template the only readers of an ingress value are NOTES.txt, which knows
its own mode, and tlsGroups, called only from behind the switch. The app
takes no base URL in its environment, so no "published" helper is needed.

First chart of the sweep whose Gateway branch has NO loss to explain, and
it was measured rather than assumed (read-only kubectl against the live
object): the running Ingress carries the cert-manager annotation plus Helm
and Rancher/Fleet bookkeeping, and not one nginx.ingress.kubernetes.io
annotation. The group-3 screen came back empty, so NOTES.txt says so
positively instead of copying a loss paragraph from another chart.

Also corrects the last occurrence in the repository of the outdated
sentence "charts in this repo deliberately have no dependencies"
(rss-bridge/templates/_helpers.tpl) - dependencies are admissible but
expensive since #214, and ytdlp-web-player, stalwart and paperless-ngx use
subcharts. The reason the helper is duplicated is unchanged, only its
content: sharing it would mean a library chart, a second artefact to
publish, version and pull for about one change a year.

Minor, not major: additive, defaults unchanged, and relaxing a required is
not a tightening. Proven with an EMPTY helm template diff against
origin/main for the defaults (229 lines, byte-identical); the Gateway mode
with its overlay renders the HTTPRoute in place of the Ingress and nothing
else changes. appVersion untouched - 2026-09-30 is the newest date tag the
registry has, everything newer is sha-* and latest.

ci/run-httproute-match-test.sh goes from 56 assertions over 21 charts to
58 over 22. The overlay at ci/httproute/rss-bridge.yaml has to SUPPLY
hostnames, the second in the repository that does (homeassistant's was the
first, for a different reason), because this chart has no fallback.

NOT PROVEN, and stated in the PR as well: that traffic flows. No Gateway
controller runs in CI and no HTTPRoute reaches "Accepted: True" there. For
this chart there is additionally NO successful install-test at all - it
fails on the Gitea runner in either mode (#51, reproduced on two images
while the same chart and image run healthy in the cluster). The chart is
deliberately NOT added to ci/excluded-charts.txt: an exclusion would
silence the signal, and the day the runner is fixed the test goes green by
itself. So the only red contexts expected here are
"Install-test / Install-test rss-bridge" and the collective
"Validate Helm Charts / Install-test".

Fixes #114
Fixes #40

rss-bridge/templates/NOTES.txt

@@ -1,6 +1,10 @@
+{{- $httpRoute := .Values.httpRoute | default dict -}}
+{{- $hostnames := $httpRoute.hostnames | default list -}}
 RSS-Bridge {{ .Chart.AppVersion }} was installed as release "{{ .Release.Name }}".
 
 {{ if .Values.ingress.enabled -}}
+ACCESS - INGRESS MODE (ingress.enabled: true, httpRoute.enabled: false)
+
 Reachable at:
 {{ range $entry := .Values.ingress.hosts }}  https://{{ $entry.host }}
 {{ end }}
@@ -8,12 +12,82 @@ Each host serves the same instance. Certificates are issued by the
 cert-manager cluster issuer "{{ .Values.ingress.clusterIssuer }}" into these secrets:
 {{ range $secret := (fromYaml (include "rss-bridge.tlsGroups" (dict "hosts" .Values.ingress.hosts "root" $))).order }}  {{ $secret }}
 {{ end }}
+Hosts sharing a secret name share one certificate with several SANs; hosts with
+distinct names get one certificate each. That grouping is what keeps the three
+grown certificates of this installation on their existing secret names.
+{{- else if $httpRoute.enabled -}}
+ACCESS - GATEWAY MODE (httpRoute.enabled: true, ingress.enabled: false)
+
+Reachable at:
+{{ range $hostnames }}  https://{{ . }}
+{{ end }}
+All of these names are served by ONE HTTPRoute ({{ .Release.Name }}-{{ .Chart.Name }}-httproute), because
+nothing differs between them: one rule, PathPrefix "/", one backend. Adding or
+removing a name is an edit to httpRoute.hostnames and nothing else.
+
+This release renders that route and NOTHING else of the routing path - no
+Gateway, no class, no Certificate. Three things therefore belong to the cluster
+and not to this chart, and if any of them is missing the hostnames above simply
+do not answer:
+
+  1. The Gateway-API CRDs. Without them this install would have failed, so
+     they are present - nothing to check.
+  2. The Gateway named in httpRoute.parentRefs
+{{- range $httpRoute.parentRefs }}
+       {{ .name }}{{ if .namespace }} in namespace {{ .namespace }}{{ end }}{{ if .sectionName }}, listener {{ .sectionName }}{{ end }}
+{{- end }}
+     must exist AND its listener must allow routes from this namespace
+     ({{ .Release.Namespace }}) in allowedRoutes. A rejected attachment is
+     visible only in the route's status:
+
+       kubectl -n {{ .Release.Namespace }} get httproute {{ .Release.Name }}-{{ .Chart.Name }}-httproute -o yaml
+
+     Read status.parents[].conditions - "Accepted: True" and
+     "ResolvedRefs: True" is what a working attachment looks like. An empty
+     status means no controller has looked at the route at all.
+  3. A TLS certificate for every hostname above, on the Gateway's listener.
+     ingress.clusterIssuer is NOT used in this mode and is not required - the
+     chart renders no Certificate here, so none of the tls-* secrets listed by
+     the Ingress mode exists and there is nothing for cert-manager to do on
+     behalf of this release.
+
+NOTHING THIS CHART DID IN INGRESS MODE IS LOST HERE
+
+Worth stating plainly, because it is not the usual case in this repository:
+most charts switched to the Gateway API give something up, since
+ingress.annotations has no counterpart in this API and an operator's
+annotation often carried real behaviour. This chart's live Ingress was measured
+before the switch and carries no nginx.ingress.kubernetes.io annotation at all -
+no body-size limit, no buffer sizes, no CORS, no rewrite, no auth. So there is
+no compensation to re-create at the Gateway and no behaviour to miss.
+
+Two things do become inert, and neither is a loss:
+
+  * ingress.annotations - gone in this mode, as everywhere. Empty here.
+  * The TLS secret grouping (rss-bridge.tlsGroups, and the per-host
+    ingress.hosts[].tlsSecretName it reads) - with the certificate on the
+    listener there is nothing left to group. This is the chart's most
+    intricate Ingress-mode machinery and it simply has no job here.
+
+What is NOT demonstrated: that traffic actually flows. No Gateway controller
+runs in this chart's CI, so no HTTPRoute of it has ever reached
+"Accepted: True" there, and this chart has no successful install-test at all
+(Gitea #51 - a runner defect, unrelated to this mode). Check the route status
+above after the first install rather than assuming it attached.
 {{- else -}}
-The Ingress is disabled (ingress.enabled=false). Reach the instance with:
+ACCESS - NEITHER INGRESS NOR HTTPROUTE
+
+ingress.enabled and httpRoute.enabled are both false, so this release has no
+Ingress, no HTTPRoute and no certificate; ingress.hosts, ingress.clusterIssuer
+and httpRoute.hostnames are not needed. Reach the instance with:
 
   kubectl --namespace {{ .Release.Namespace }} port-forward svc/{{ .Release.Name }}-{{ .Chart.Name }}-service 8080:80
 
 and open http://localhost:8080
+
+To publish it instead, set either ingress.enabled=true with ingress.hosts and
+ingress.clusterIssuer, or httpRoute.enabled=true with httpRoute.hostnames and
+httpRoute.parentRefs.
 {{- end }}
 
 Enabled bridges ({{ len .Values.whitelist }} entr{{ if eq (len .Values.whitelist) 1 }}y{{ else }}ies{{ end }} in whitelist.txt):