Conventions batch 4: env blocks, homeassistant className default, strict clusterIssuer

- apache-tika, gotenberg, cyberchef, homeassistant, patchmon: additive env
  value blocks rendered through tpl (value, secretKeyRef and configMapKeyRef
  forms), following the template-chart/outline pattern; patchmon gets separate
  blocks for the server container and the guacd sidecar.
- homeassistant: ingress.className now defaults to nginx; an empty className
  omits ingressClassName from the rendered Ingress, so the flexible upstream
  ingress style stays intact.
- outline, paperless-ngx: remove the ingress.clusterIssuer defaults
  (letsencrypt / letsencrypt-issuer) - the value is now strictly required,
  consistent with the repo-wide ingress standard; CI test-values set it
  explicitly.

Chart bumps: apache-tika 7.2.0, gotenberg 4.2.0, cyberchef 5.2.0,
patchmon 5.2.0, homeassistant 4.2.0 (minor); outline 5.0.0,
paperless-ngx 10.0.0 (major).

ci/paperless-ngx/test-values.yaml

@@ -5,6 +5,9 @@ secrets:
 
 ingress:
   domain: paperless.ci.local
+  # clusterIssuer is strictly required (no default); the Ingress just has to
+  # apply - there is no cert-manager in the CI cluster.
+  clusterIssuer: ci
 
 # smbConnection and oidc stay disabled (defaults): the SMB CSI driver and a
 # real OIDC login flow are out of scope for the CI install-test.