VoucherVault chart: complete security hardening, flexible ingress

Enable readOnlyRootFilesystem and drop all capabilities by default. The
paths the image writes at runtime are covered by emptyDirs (/tmp,
/opt/app/logs and STATIC_ROOT /opt/app/myapp/static); an init container
seeds the static volume with the assets shipped in the image because the
directory doubles as the app's static source. The ephemeral-storage
request covers the ~90Mi static emptyDir.

Move the Ingress to the repo-standard flexible style: ingress.className
value (default nginx) instead of a hardcoded ingressClassName, and
ingress.annotations merged with the cert-manager annotation. domain and
clusterIssuer stay required; the TLS secret name was already standard.

Major bump 3.1.2+up1.30.1 -> 4.0.0+up1.30.1 (hardening changes runtime
behavior). App version unchanged. Part of #32.

voucher-vault/values.yaml

@@ -21,7 +21,10 @@ voucherVault:
     requests:
       cpu: 0.1
       memory: 256Mi
-      ephemeral-storage: 10Mi
+      # The static-files emptyDir (~90Mi of static assets, see the
+      # securityContext comment) counts toward the pod's ephemeral-storage
+      # usage, so the request must cover it.
+      ephemeral-storage: 128Mi
   # "/" answers with a redirect for anonymous users, which httpGet treats as
   # success. The Host header must be set to 127.0.0.1 because Django's
   # ALLOWED_HOSTS only accepts 127.0.0.1 and the configured DOMAIN — probing
@@ -57,6 +60,13 @@ voucherVault:
     periodSeconds: 5
     timeoutSeconds: 5
     failureThreshold: 30
+  # The upstream image (l4rm4nd/vouchervault) runs as www-data (uid/gid 33).
+  # With readOnlyRootFilesystem the chart mounts emptyDirs over the paths the
+  # image writes at runtime: /tmp (upload/PDF scratch files), /opt/app/logs
+  # and STATIC_ROOT /opt/app/myapp/static (the entrypoint runs collectstatic
+  # at every start; an init container seeds the volume with the static files
+  # shipped in the image, because the directory doubles as the app's static
+  # source). Uploads and the database live on the PVC at /opt/app/database.
   securityContext:
     pod:
       runAsNonRoot: true
@@ -66,7 +76,11 @@ voucherVault:
       fsGroupChangePolicy: Always
     container:
       allowPrivilegeEscalation: false
+      readOnlyRootFilesystem: true
       runAsNonRoot: true
+      capabilities:
+        drop:
+          - ALL
   ports:
     - containerPort: 8000
       protocol: TCP
@@ -185,3 +199,7 @@ ingress:
   enabled: true
   clusterIssuer: null
   domain: null
+  className: nginx
+  # Extra annotations for the Ingress; merged with the cert-manager
+  # cluster-issuer annotation the chart always sets.
+  annotations: {}