feat: Gateway-API as an alternative to the Ingress in five annotation charts

Group 2 of the #114 sweep: the charts whose behaviour hangs off an nginx
annotation - calibre-web-automated, outline, paperless-ngx, zipline
(proxy-body-size) and freesailarr (rewrite-target).

Each gets the form the pilot (cyberchef, PR #115) fixed and group 1 (PR #116)
repeated: an httpRoute block off by default, a template rendering ONLY an
HTTPRoute with parentRefs - no Gateway, no gatewayClassName, no Certificate, no
implementation-specific policy object - render aborts on both modes at once
(naming both value paths), on an empty parentRefs and on a missing hostname,
empty hostnames meaning [ingress.domain], a schema entry closed against unknown
keys with an open parentRef definition, and a NOTES.txt that names the active
mode and what the mode costs.

Minor, additive, defaults unchanged: `helm template` with each chart's CI values
is byte-identical to origin/main for all five.

The upload limit is DOCUMENTED, not rebuilt (decision 2 of the issue). The
Gateway API knows no body size; a policy object would bind the chart to one
implementation. So the Gateway branch of NOTES.txt says, per chart and in the
chart's own terms, that the value is NOT ENFORCED and names where to set it: an
e-book library (calibre), an upload service (zipline), the web-UI half of the
document intake while the consume directory keeps no limit at all (paperless),
and the open #12 pair (outline).

Four findings that were not in the plan, each argued in the file it changes:

  freesailarr gated freesailarr.sharedIngressApps on ingress.enabled, and that
  list is read by the <APP>__SERVER__URLBASE variables as well as by the routing
  objects. In Gateway mode it would have come out EMPTY while the route served
  radarr, sonarr and prowlarr under their prefixes: UrlBase unset, assets and API
  calls linked at the host root, broken UI behind a Ready pod. The helper's two
  guards (seerr/mediathekarr only at "/", no duplicate paths) would have gone
  unenforced there too. Fixed with freesailarr.published (ingress.enabled OR
  httpRoute.enabled) - the same shape as sure.publishedOverTls in group 1, and
  identical to ingress.enabled while httpRoute.enabled is false. Measured: on
  origin/main with ingress.enabled: false the render emits ZERO URLBASE
  variables; with this change in Gateway mode it emits three.

  paperless-ngx was the last chart in the repository rendering its Ingress
  UNCONDITIONALLY. Without an ingress.enabled switch there is no second value
  path for the mutual-exclusion abort to name, and the Ingress plus its
  unconditional required() on clusterIssuer would have kept rendering in Gateway
  mode - a value demanded for nothing, which is issue #114's "Folge 1" and
  README guideline 12. The switch was added, defaulting to true, so the render is
  unchanged.

  paperless-ngx PAPERLESS_URL had no required() of its own: it relied on the
  Ingress template's, which stops firing the moment the Ingress is switchable.
  With httpRoute.hostnames set and ingress.domain empty it would have rendered
  "https://" and refused every login POST as a CSRF failure. It now carries its
  own required(), naming what the value is for.

  calibre-web-automated claimed, in values.yaml and in its schema, that
  ingress.domain is read nowhere but in the Ingress template. The HTTPRoute reads
  it, so the claim now holds only while both modes are off. Corrected rather than
  left standing - the same correction garage needed in group 1.

freesailarr is where the Gateway API is LESS machinery than what it replaces,
not a translation of it. rewrite-target applies per Ingress OBJECT, so
qBittorrent (no base path, prefix must be stripped) needed a second Ingress on
the shared host, which then had to repeat the first object's TLS secret name,
omit the cert-manager annotation conditionally so only one Certificate is
requested, and match an ImplementationSpecific regex path for the rewrite's
capture group. A URLRewrite filter applies per RULE: one route, one rule per
app, the filter on qBittorrent's rule, a plain PathPrefix. All four crutches
gone. It is also the only chart without httpRoute.hostnames - it has no
ingress.domain either, and a chart-global hostname list could not say which of
the ten apps it belonged to, so the hostnames stay in ingress.host and
<app>.ingress.host.

CI: one render overlay per chart under ci/httproute/, so the assertion is not
vacuum-green - ci/run-httproute-match-test.sh goes from 20 held assertions over
10 charts to 36 over 15. freesailarr's overlay moves bazarr onto a host of its
own, so the shared-host route AND the per-app route are both rendered; without
that the per-app branch would be exercised by nothing. The install-test fixtures
stay in Ingress mode: the install runs one configuration per chart, cyberchef
already pays that price against the real Gateway-API CRDs, and for paperless-ngx
that fixture is the only install of the valkey-subchart path anywhere.

README also carries a stale figure fixed here: the HTTPRoute test was still
documented at the pilot's 4 assertions over 2 charts, although group 1 had taken
it to 20 over 10.

Not proven, by construction: that traffic flows. No Gateway controller runs in
CI. Not run locally either: k3d, Docker, Trivy. The Gateway branch of NOTES.txt
is EXECUTED by the render test (a template error in it fails the job, verified)
but its text is printed by no pipeline stage - helm template does not emit
notes, and the install-test installs in Ingress mode.

Part of #114

freesailarr/templates/_helpers.tpl

@@ -205,8 +205,49 @@ in the ingress, which addresses a service port by name.
 {{- end -}}
 
 {{/*
-The apps that render an Ingress: the enabled port apps whose values carry an
-ingress block with enabled: true. Used by the ingress template.
+Is this release published through a routing object at all? Returns the string
+"true" or the empty string (falsy in a template "if").
+
+Input: the root context.
+
+ONE PLACE, BECAUSE THE WRONG ANSWER IS INVISIBLE (Gitea #114)
+
+ingress.enabled is the chart's master switch, and until the Gateway-API mode
+existed it was also the answer to "is anything published". It stopped being
+that answer in exactly one configuration - and that configuration is the whole
+point of the new mode: httpRoute.enabled: true forces ingress.enabled: false
+(the two are mutually exclusive, the render aborts otherwise), while the apps
+ARE published, now through HTTPRoutes.
+
+The consumer that makes this load-bearing is NOT the routing templates - those
+know their own mode - but freesailarr.sharedIngressApps below, which is also
+read by the <APP>__SERVER__URLBASE environment variables (see
+freesailarr.urlBase). Read from ingress.enabled alone, that list would come out
+EMPTY in Gateway mode, so Radarr, Sonarr and Prowlarr would be told no base
+path while their routes serve them under /radarr, /sonarr and /prowlarr. Each
+app would then answer at the sub-path with a page whose assets and API calls
+are linked at the host root, i.e. a broken UI behind a Ready pod - the same
+silent class as sure's TLS flags, found in the same sweep. The duplicate-path
+and root-only guards in that helper would also have gone unenforced in Gateway
+mode, for the same reason.
+
+With httpRoute.enabled at its default of false this expression IS
+ingress.enabled, which is why adding it changes nothing for an existing
+release: `helm template` with unchanged values renders byte-identically.
+*/}}
+{{- define "freesailarr.published" -}}
+{{- $httpRoute := .Values.httpRoute | default dict -}}
+{{- if or .Values.ingress.enabled $httpRoute.enabled -}}true{{- end -}}
+{{- end -}}
+
+{{/*
+The apps that are published through a routing object: the enabled port apps
+whose values carry an ingress block with enabled: true. Used by BOTH routing
+templates - the per-app <app>.ingress.enabled toggle selects which apps are
+exposed in Ingress mode and in Gateway mode alike, and only the Ingress-only
+fields of that block (clusterIssuer, className, annotations) have no meaning in
+the second one. The name is historical; renaming it would churn every call site
+for no behaviour.
 
   {{- $apps := include "freesailarr.ingressApps" . | fromJsonArray }}
 */}}
@@ -252,14 +293,19 @@ The apps served under the shared domain (ingress.host), as a JSON array of
 is deterministic.
 
 The shared-domain mode is off unless ingress.host is set; then it covers the
-apps whose ingress renders at all (freesailarr.ingressApps, i.e. the enabled
-port apps with ingress.enabled) and which do not carry a host of their own. A
-per-app host always wins and keeps rendering its own object exactly as before,
-which is what makes mixed operation fall out for free.
+apps whose routing object renders at all (freesailarr.ingressApps, i.e. the
+enabled port apps with ingress.enabled) and which do not carry a host of their
+own. A per-app host always wins and keeps rendering its own object exactly as
+before, which is what makes mixed operation fall out for free.
 
-Two guards live here rather than in the ingress template, so that every
-consumer - the ingress objects, the UrlBase env vars and NOTES.txt - sees the
-same validated list:
+Gated on freesailarr.published and NOT on ingress.enabled (Gitea #114): this
+list is read by the UrlBase env vars too, and in Gateway mode ingress.enabled
+is false by construction while the apps are published all the same. See that
+helper for what reading the switch directly would have broken silently.
+
+Two guards live here rather than in the routing templates, so that every
+consumer - the Ingress objects, the HTTPRoutes, the UrlBase env vars and
+NOTES.txt - sees the same validated list:
 
   1. seerr or mediathekarr under any path other than "/". seerr has no base-path
      support (upstream request open since May 2022) and MediathekArr's UI links
@@ -277,7 +323,7 @@ same validated list:
 {{- $root := . -}}
 {{- $apps := list -}}
 {{- $host := $root.Values.ingress.host | default "" -}}
-{{- if and $root.Values.ingress.enabled $host -}}
+{{- if and (include "freesailarr.published" $root) $host -}}
 {{- $seen := dict -}}
 {{- range $app := include "freesailarr.ingressApps" $root | fromJsonArray -}}
 {{- $config := (index $root.Values $app.name).ingress -}}
@@ -320,9 +366,16 @@ base path from this environment variable (schema
 <APP>__CONFIGNAMESPACE__CONFIGITEM, https://wiki.servarr.com/sonarr/environment-variables),
 so the chart can configure them itself as soon as they render under a sub-path.
 
+Mode-independent by construction (Gitea #114): the sub-path an app is served
+under is the same in Ingress and in Gateway mode, so this variable follows
+freesailarr.sharedIngressApps and not the routing object. That is only true
+because that helper asks freesailarr.published rather than ingress.enabled -
+reading the switch directly would have emptied this variable in Gateway mode
+while the route still served the app under its prefix.
+
 Empty - i.e. the chart sets nothing - in three cases:
 
-  - the app does not render under the shared host, or renders at "/";
+  - the app is not served under the shared host, or is served at "/";
   - the app's own env block already carries the variable. The env blocks are
     documented as additive; emitting a second entry with the same name would
     break that promise, and two identically named variables in one container