minecraft-router: strict values.schema.json and null-safe hardening

No ingress gate: this chart has no Ingress at all (clients reach it via a
NodePort), and ingress.domain appears neither in its templates nor in its
values.

1. values.schema.json (#68): additionalProperties: false on every
   chart-owned object level, including the entries of the mappings list,
   where domain and internalUrl are required.

2. Null-safety for hardening, probes and resources (#99). Two things a
   rebuilt default probe must not lose, both verified:
   - the API port is addressed by NAME ("api-port"), so the probe keeps
     working when server.apiPort is overridden.
   - mc-router still has no /health endpoint in 1.46.4, so GET /routes is
     the health signal, and the "Accept: application/json" header belongs
     to that request.

   The pod context keeps pinning uid/gid 10000 even though the image
   declares USER 65532 since 1.46.0, so the runtime identity does not
   silently change with the base image.

mappings stays deliberately not null-safe: the chart fails loudly on a
missing or empty routing table, which is the loud class #99 excludes - a
router without routes is not operable and has no sensible default.

Rendering with normal values is byte-identical to 2.0.0.

minecraft-router/templates/minecraft-router.deployment.yaml

@@ -24,7 +24,7 @@ spec:
     spec:
       automountServiceAccountToken: false
       securityContext:
-        {{- toYaml .Values.server.securityContext.pod | nindent 8 }}
+        {{- include "minecraft-router.podSecurityContext" .Values.server.securityContext | nindent 8 }}
       containers:
         - name: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
           image: "itzg/mc-router:{{ .Chart.AppVersion }}"
@@ -65,15 +65,15 @@ spec:
               protocol: TCP
               containerPort: {{ .Values.server.apiPort }}
           livenessProbe:
-            {{- toYaml .Values.server.livenessProbe | nindent 12 }}
+            {{- include "minecraft-router.livenessProbe" .Values.server.livenessProbe | nindent 12 }}
           readinessProbe:
-            {{- toYaml .Values.server.readinessProbe | nindent 12 }}
+            {{- include "minecraft-router.readinessProbe" .Values.server.readinessProbe | nindent 12 }}
           startupProbe:
-            {{- toYaml .Values.server.startupProbe | nindent 12 }}
+            {{- include "minecraft-router.startupProbe" .Values.server.startupProbe | nindent 12 }}
           resources:
-            {{- include "minecraft-router.resources" .Values.server.resources | nindent 12 }}
+            {{- include "minecraft-router.effectiveResources" .Values.server.resources | nindent 12 }}
           securityContext:
-            {{- toYaml .Values.server.securityContext.container | nindent 12 }}
+            {{- include "minecraft-router.containerSecurityContext" .Values.server.securityContext | nindent 12 }}
           volumeMounts:
             - name: config-mount
               mountPath: /data/custom-routing-config.json