feat(outline)!: NetworkPolicy, on by default

Major, as every chart in this rollout is.

Inbound 3000 only; outbound DNS plus 5432, 6379 and 443. Those three egress
ports are the STANDARD ones and not the configured ones, which is this chart's
real limitation and is written into values.yaml, the template header and
NOTES.txt rather than left to be discovered: Outline's database, Redis and OIDC
provider all arrive as connection URLs inside 1Password items that the chart
never parses, so it cannot know where they listen and cannot validate a guess.
A dependency on another port is blocked, and because all three probes hit
/_health - which checks Postgres and Redis - the symptom is a pod that never
becomes Ready rather than an error anyone reads. networkPolicy.egress.extraPorts
is the escape hatch.

That same property is what makes this chart the right place for the enforcement
experiment in the next commit.

Also reverts the cyberchef fixture from the first experiment: with the probe
port restricted to an address that is not the node's, the install-test went
GREEN, so the claim that it catches a blocked probe path does not hold as
written. The next commit establishes whether policies are enforced in CI at
all.

Part of #5

outline/values.yaml

@@ -171,3 +171,90 @@ httpRoute:
   # link, every share URL and the OIDC redirect URI still name the old host
   # until ingress.domain is changed too.
   hostnames: []
+
+# ---------------------------------------------------------------------------
+# NetworkPolicy (Gitea #5). On by default. The reference implementation with
+# the full reasoning is template-chart; the convention is in README, "Chart
+# style guidelines", and the operator's view on this chart's wiki page.
+# ---------------------------------------------------------------------------
+networkPolicy:
+  # WHAT THIS POLICY ALLOWS: inbound 3000 only - the single port this pod
+  # declares - and outbound DNS plus TCP 5432 (Postgres), 6379 (Redis) and 443
+  # (the OIDC provider's discovery document, fetched at boot).
+  #
+  # WHAT IT DOES NOT DO, and this is the one to read before upgrading: THOSE
+  # THREE EGRESS PORTS ARE THE STANDARD ONES, NOT THE CONFIGURED ONES. Outline's
+  # database, Redis and OIDC provider all arrive as connection URLs inside
+  # 1Password items, which this chart never parses - so it cannot know your
+  # ports and cannot validate them. A dependency on a non-standard port is
+  # BLOCKED, and because all three probes hit /_health (which checks Postgres
+  # and Redis), that shows up as a pod which never becomes Ready. Put the real
+  # port in egress.extraPorts below.
+  #
+  # The 3000 rule is NOT restricted by source in the default - 3000 is the
+  # probe port, see probeSources. And a policy is only a boundary where the CNI
+  # enforces one; unenforced, it is accepted and filters nothing.
+  enabled: true
+  # Namespaces whose pods may reach this workload, in addition to the release's
+  # own namespace, which is always allowed. Empty means: own namespace only.
+  #
+  # Matched on the "kubernetes.io/metadata.name" label Kubernetes sets on every
+  # namespace itself, so no labelling work is needed on a namespace this chart
+  # does not own - and no typo protection either: a name that does not exist
+  # matches nothing and is silently ineffective. Note the granularity: an entry
+  # opens the port to EVERY pod in that namespace.
+  allowedNamespaces: []
+  # Source CIDRs allowed to reach port 3000, which is the port all three probes address.
+  #
+  # EMPTY MEANS OPEN, NOT BLOCKED. With no entry that rule is rendered WITHOUT a
+  # "from" selector, so the port is reachable from anywhere the CNI routes to -
+  # inside the cluster, since it carries no NodePort.
+  #
+  # That is the deliberate choice between two bad defaults. The kubelet's probes
+  # originate from the IP of the WORKER NODE running the pod, an address this
+  # chart cannot know and must not guess: a CIDR that excludes the real node
+  # blocks every probe, the pod never becomes Ready, the rollout times out, and
+  # the symptom reads as a broken application rather than as a policy.
+  #
+  # Narrow it by listing the worker node IPs (e.g. ["10.0.1.11/32"]) - and mind
+  # the companion trap: once this list is non-empty the rule IS restricted, so
+  # everything else that needs the port has to be in it. The chart adds the own
+  # namespace, the ingressController below and allowedNamespaces to the same rule for exactly that reason.
+  probeSources: []
+  # The ingress controller allowed to reach the routed port once probeSources
+  # restricts it. Rendered only while ingress.enabled or httpRoute.enabled is true, and only in
+  # the restricted branch - with the default (open) rule the controller reaches
+  # the port anyway. The two keys become ONE "from" entry and are therefore an
+  # AND: pods carrying podLabels IN namespace. That is the point of having them
+  # at all - the controller's namespace in allowedNamespaces would open the port
+  # to every pod in kube-system.
+  #
+  # MEASURED ON THIS CLUSTER, NOT ASSUMED (2026-10-14): ingress-nginx is gone,
+  # the only IngressClass is "traefik" and it is the default, and the controller
+  # is the DaemonSet rke2-traefik in kube-system. The same Traefik serves the
+  # Gateway API here, so this one source covers the Ingress and the HTTPRoute
+  # path alike. A policy written against the wrong controller is accepted, looks
+  # strict, and silently blocks all web traffic - and ingress.className says
+  # nothing about it, because a class names an implementation, not the pods the
+  # traffic comes from.
+  ingressController:
+    namespace: kube-system
+    podLabels:
+      app.kubernetes.io/name: rke2-traefik
+  egress:
+    # Additional outbound TCP ports. DNS (UDP and TCP 53) is always allowed and
+    # has no switch - a knob whose only other setting breaks every name lookup
+    # in the pod is a trap, not a feature.
+    #
+    # PORTS, NOT DESTINATIONS, and that is a limit of the object rather than
+    # laziness: a NetworkPolicy matches CIDRs and selectors and never hostnames,
+    # so "only to the database host" cannot be written at all. Each entry
+    # permits its port to ANY destination. What the cap still buys is real: a
+    # compromised pod cannot open arbitrary outbound connections.
+    #
+    # Outline needs one entry here more often than most charts: a Postgres or
+    # Redis on a non-standard port, an OIDC provider that is not on 443 (a CI
+    # dex on 5556), an S3 endpoint on a custom port, or SMTP - the chart sets
+    # no SMTP_* variable itself, but a deployment that adds them through
+    # outline.env needs 587 or 465 here too.
+    extraPorts: []