feat!: NetworkPolicy in nine more charts, on by default

bulwark, calibre-web-automated, patchmon, rallly, urlaubsverwaltung,
voucher-vault, zipline, sure, homeassistant. One major each.

These are the charts with real outbound dependencies, and they all share one
limitation that is now written into every one of them: THE EGRESS PORTS ARE THE
STANDARD ONES, NOT THE CONFIGURED ONES. Databases, caches and OIDC issuers
arrive as connection URLs or as fields inside 1Password items that the charts
never parse, so a chart cannot know where its dependency listens and cannot
validate a guess. A dependency somewhere else is blocked, and
networkPolicy.egress.extraPorts is the escape hatch. That is the upgrade risk
of this rollout, stated per chart instead of discovered per release.

Four of them differ in ways that mattered:

HOMEASSISTANT gets policyTypes: [Ingress] and NO egress section at all, and
that is the decision in the file rather than an omission. Its outbound traffic
is the union of every integration an operator enables - mDNS and SSDP
discovery, MQTT, a Zigbee or Z-Wave bridge on whatever port its firmware chose,
ESPHome, printers, speakers, inverters, cloud APIs, NTP - which no chart can
know. A cap would protect little, since the devices sit on the node's own LAN,
and would break integrations one at a time, months apart, each looking like a
flaky device rather than like a policy. So valkey's rule applies in the other
direction: policyTypes names only what there is something to restrict.

URLAUBSVERWALTUNG allows BOTH 5432 and 3306, deliberately. It is handed a full
JDBC URL inside a 1Password item and never parses it, so it cannot tell
PostgreSQL from MariaDB - and this cluster runs both. Allowing one would break
half the possible deployments on upgrade, with the symptom buried in a Java
stack trace. A small widening against a large and silent failure.

RALLLY derives its SMTP rule from rallly.smtp.enabled rather than always
rendering it: with mail switched off there is nothing to permit, and a rule
that permits nothing makes the object look stricter than it is.

BULWARK is the chart where the cap can fail most quietly. Its probes test its
own port and say nothing about the JMAP server, so a jmapServerUrl on a port
the policy does not allow yields a Ready pod serving an empty webmail. 443 is
allowed, Stalwart's in-cluster 8080 is not, and both halves of that are in
values.yaml and NOTES.txt.

PATCHMON and HOMEASSISTANT select their pods by the BARE release-and-chart
label, with no -deployment or -sfs suffix. Copying a selector from a
neighbouring chart would have matched nothing and left a policy that filters
nothing - which is precisely the first assertion of the render test.

Five CI fixtures gain networkPolicy.egress.extraPorts, and they are the only
place in the repository where the cap's cost is actually exercised: the CI dex
runs on 5556 rather than 443 (patchmon, rallly, urlaubsverwaltung,
voucher-vault) and the CI JMAP server on plain 8080 (bulwark).

Part of #5

voucher-vault/templates/voucher-vault.networkpolicy.yaml

@@ -0,0 +1,183 @@
+{{- /*
+NetworkPolicy for voucher-vault (Gitea #5).
+
+Voucher-Vault reaches a Postgres, a Redis and an OIDC provider, all three
+configured through 1Password items the chart never parses - so the egress rules
+name the standard ports (5432, 6379, 443) and a dependency elsewhere is blocked
+until networkPolicy.egress.extraPorts says otherwise.
+
+WHAT THIS OBJECT IS: a ceiling on reachability, not an authentication layer.
+Only the ports declared below are reachable at all - whatever else the process
+binds, now or after the next app update, is blocked without anyone having to
+notice it exists.
+
+WHAT IT IS NOT:
+  - EGRESS IS COARSE. A NetworkPolicy matches CIDRs and selectors and NEVER
+    hostnames, so "only to the database host" cannot be expressed at all. This
+    cluster's CNI is Canal (Flannel plus Calico for policy) and has no FQDN
+    rule; Calico's GlobalNetworkSet could express one but would bind this chart
+    to Calico, the same argument that kept implementation-specific objects out
+    of the Gateway-API sweep (#114). Each egress rule therefore permits its
+    PORT to any destination.
+  - NOT A BOUNDARY WHERE THE CNI DOES NOT ENFORCE ONE. An unenforced policy is
+    accepted by the API server and filters nothing, so everything reads as
+    configured while nothing is filtered.
+  - THE REASONING IS IN TEMPLATE COMMENTS, not in "#" comments: those are part
+    of the rendered object, travel into the cluster and appear in every release
+    diff. ci/run-networkpolicy-test.sh fails on a rendered "#".
+
+THE PORT NUMBERS BELOW ARE POD PORTS, NEVER NODEPORTS. A NetworkPolicy is
+evaluated at the pod's network interface, after kube-proxy has already
+translated a NodePort to the targetPort, so a NodePort number here would match
+nothing while looking strict - and, being the only rule for that port, would
+block every inbound connection instead. ci/run-networkpolicy-test.sh asserts
+every port here against the containerPorts of the pod spec this policy
+selects.
+*/ -}}
+{{- if .Values.networkPolicy.enabled }}
+{{- $np := .Values.networkPolicy }}
+{{- $ns := .Release.Namespace }}
+{{- $probeSources := $np.probeSources | default list }}
+{{- $allowedNs := $np.allowedNamespaces | default list }}
+{{- $ic := $np.ingressController | default dict }}
+{{- $routed := .Values.ingress.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ .Release.Name }}-{{ .Chart.Name }}-networkpolicy
+  labels:
+    app: {{ .Release.Name }}-{{ .Chart.Name }}-networkpolicy
+spec:
+  {{- /*
+  Selects the StatefulSet's pods. ci/run-networkpolicy-test.sh fails if
+  this matches no pod spec of the same render - which is the mistake that
+  would otherwise leave a policy in the namespace filtering nothing, and
+  its usual cause is a label renamed in the workload template.
+  */}}
+  podSelector:
+    matchLabels:
+      app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
+  policyTypes:
+    - Ingress
+    {{- /*
+    Egress is listed because there IS something to restrict: this workload
+    needs DNS and the ports named below, and nothing else. A chart whose
+    workload opens no outbound connection of its own must NOT list Egress -
+    valkey is the example - because a rule that constrains nothing makes the
+    object look stricter than it is.
+    */}}
+    - Egress
+  ingress:
+    {{- /*
+    8000 - the only port this pod declares, the one the Service forwards 80 to, and
+    the port all three probes address. The probe path.
+    */}}
+    - ports:
+        - protocol: TCP
+          port: 8000
+      {{- if $probeSources }}
+      {{- /*
+      RESTRICTED, because the operator supplied probeSources. The kubelet's probes
+      come from the IP of the WORKER NODE running the pod, so that address has to be
+      in the list or the pod never becomes Ready - and a pod that is never Ready
+      reads as a broken application rather than as a policy.
+
+      The ingress controller is added to the same rule, or the Ingress goes dark the
+      moment this list is filled.
+      */}}
+      from:
+        - namespaceSelector:
+            matchLabels:
+              {{- /*
+              Set by Kubernetes itself on every namespace (>= 1.21), so this needs no
+              labelling work on a namespace this chart does not own.
+              */}}
+              kubernetes.io/metadata.name: {{ $ns }}
+        {{- if and $routed $ic.namespace }}
+        {{- /*
+        ONE from-entry with TWO selectors, which is an AND: pods carrying these labels
+        IN that namespace. Written as two list entries it would be an OR, and would
+        open the port to every pod in kube-system.
+        */}}
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: {{ $ic.namespace | quote }}
+          {{- with $ic.podLabels }}
+          podSelector:
+            matchLabels:
+              {{- toYaml . | nindent 14 }}
+          {{- end }}
+        {{- end }}
+        {{- range $allowedNs }}
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: {{ . | quote }}
+        {{- end }}
+        {{- range $probeSources }}
+        - ipBlock:
+            cidr: {{ . | quote }}
+        {{- end }}
+      {{- else }}
+      {{- /*
+      NO "from" SELECTOR, WHICH MEANS OPEN - deliberately, and only inside the
+      cluster, because this port carries no NodePort. The alternative was to guess
+      the worker node CIDRs, and a wrong guess blocks every kubelet probe: the pod
+      stays un-Ready, the rollout times out, and the cause looks like the
+      application. An empty "from: []" would be worse than either - it allows
+      everything too, but while reading as a restriction. Narrow it with
+      networkPolicy.probeSources.
+      */}}
+      {{- end }}
+  egress:
+    {{- /*
+    DNS, unconditionally. There is no value to switch this off, and that is
+    deliberate: a knob whose only other setting breaks every name lookup in
+    the pod is a trap and not a feature.
+    */}}
+    - ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+    {{- /*
+    PostgreSQL on the STANDARD port. The connection details live in a 1Password
+    item the chart never parses, so this is the conventional port and not the
+    configured one; a Postgres anywhere else is blocked and belongs in
+    networkPolicy.egress.extraPorts.
+    */}}
+    - ports:
+        - protocol: TCP
+          port: 5432
+    {{- /*
+    Redis/Valkey on the STANDARD port, same reasoning as Postgres above: the URL
+    sits in a secret this chart does not read.
+    */}}
+    - ports:
+        - protocol: TCP
+          port: 6379
+    {{- /*
+    Outbound HTTPS, for the OIDC provider: the chart fetches the issuer's
+    configuration and exchanges tokens over it, and the issuer URL lives inside a
+    1Password item the chart never parses. 443 to any destination is as narrow as
+    this object gets for that - a hostname cannot appear in a NetworkPolicy. An
+    issuer on another port (a CI dex on 5556) needs
+    networkPolicy.egress.extraPorts.
+    */}}
+    - ports:
+        - protocol: TCP
+          port: 443
+    {{- with $np.egress }}
+    {{- with .extraPorts }}
+    {{- /*
+    Ports only, to any destination - see the header. This is the operator's
+    escape hatch from the egress cap, and the only alternative to switching
+    the whole policy off.
+    */}}
+    - ports:
+        {{- range . }}
+        - protocol: TCP
+          port: {{ int . }}
+        {{- end }}
+    {{- end }}
+    {{- end }}
+{{- end }}