Minecraft-router chart: naming scheme, hardening, probes, values interface

Stage 2 of the Fleet migration for minecraft-router: bring the chart up to the
repo style guidelines. Chart 0.1.1+up1.25.1 -> 1.0.0+up1.25.1 (major: resource
renames, mappings becomes required, probes and security hardening change the
runtime behavior; appVersion unchanged).

- Resources renamed to {{ .Release.Name }}-{{ .Chart.Name }}-<kind>, templates
  to <chart>.<kind>.yaml; the deployment label now matches its own selector.
- mappings is required and must not be empty (the old default rendered
  "<nil>": "<nil>:25565"); every entry needs domain and internalUrl.
- Ports come from values: server.port (router listen port, also passed as
  --port), server.backendPort (default backend port, overridable per mapping),
  server.apiPort (--api-binding, used by the probes). Defaults stay 25565 /
  25565 / 8080, server.outwardPort keeps its 25565 default and comment.
- _helpers.tpl added (resources/limitFactor and replicas/scaleDown helpers),
  resources come from values, no CPU limit.
- replicas value plus the chart-global scaleDown flag.
- Additive env block rendered through tpl (value / secretKeyRef /
  configMapKeyRef).
- Values-configurable securityContext.pod / .container with hardened defaults:
  non-root uid/gid 10000, readOnlyRootFilesystem, no privilege escalation, all
  capabilities dropped.
- Liveness, readiness and startup probes on the mc-router API: GET /routes with
  an "Accept: application/json" header (the API router matches on that header
  and answers 404 without it).
- icon added to Chart.yaml.
- CI fixture supplies mappings; README chart table entry updated.

README.md

@@ -12,7 +12,7 @@ Collection of some self-made helm-charts. Each top-level directory is a standalo
 | `gotenberg` | Gotenberg | Deployment + Service only (no ingress) |
 | `homeassistant` | Home Assistant | StatefulSet, has `NOTES.txt` and Helm tests |
 | `matrix-synapse` | Matrix Synapse | StatefulSet plus an nginx delegation Deployment/Service |
-| `minecraft-router` | itzg/mc-router | Deployment + routing ConfigMap + NodePort Service (TCP only, no ingress); pre-existing chart, still on its legacy conventions |
+| `minecraft-router` | itzg/mc-router | Deployment + routing ConfigMap + NodePort Service (TCP only, no ingress); `mappings` is a required value |
 | `outline` | Outline | StatefulSet, separate DB/Redis secrets |
 | `paperless-ngx` | Paperless-ngx | Largest chart: consume CronJob, SMB-connector PV/PVC, pre/post-consumption scripts ConfigMap |
 | `patchmon` | PatchMon | Two Deployments (frontend + backend), OIDC secret |