feat(gotenberg): a named switch for remote assets, off by default

The maintainer's decision, and it keeps restrictive-by-default intact: not an
opening but networkPolicy.egress.remoteAssets, whose purpose is in its name
instead of being an unplaceable [80, 443] in extraPorts. Additive inside the
major this chart already carries in this PR, so no second version step.

WHAT IT BUYS, measured rather than assumed. paperless-ngx splits a mail into
two steps with two separate cluster-internal endpoints: the .eml goes to TIKA
for parsing (PAPERLESS_TIKA_ENDPOINT) and the resulting HTML comes here for
rendering (PAPERLESS_TIKA_GOTENBERG_ENDPOINT). Of the images in that HTML,
EMBEDDED ones are MIME parts inside the file and need no network from either
service - which is why apache-tika stays DNS-only and is unchanged - while
REMOTE ones (<img src="https://...">) are fetched by Chromium here, at render
time. With the switch off they are silently dropped: the PDF is produced and is
simply missing them, nothing fails, nothing is logged, no probe notices. That
invisibility is the reason the switch exists.

NOT CHECKED, and written down as not checked rather than implied: whether
paperless-ngx re-embeds the images Tika extracted before handing the HTML over.
If it does not, embedded images would be lost too - but that would be
pre-existing paperless behaviour and not this policy, so the switch is not a
fix for it.

The SSRF argument is unchanged and is why the default is off: Gotenberg drives
a headless Chromium and 3000 is its probe port, so the service is reachable
from the whole cluster, and outbound web access turns anything that can POST
here into a way of fetching arbitrary URLs.

Two things the implementation needed, and one of them was a real defect. The
NOTES.txt branch read .Values.networkPolicy.egress.remoteAssets directly, which
fails the whole render with "nil pointer evaluating interface
{}.remoteAssets" when an operator erases the egress block - the schema permits
null there, and issue #99's rule is that an erased block means "the default
applies", not a broken render. It is null-safe now, and an erased block falls
back to DNS-only, which is the restrictive direction. And ci/networkpolicy/
gotenberg.yaml makes the switch's ON state permanent in CI rather than checked
once by hand: it renders both the switch's egress rule and the
source-restricted probe branch, so all five assertions run over the toggle in
both positions on every pull request. Worth having precisely because assertions
2 and 3 look at INGRESS rules - an egress mistake has no other mechanical
check.

Also, three things that were load-bearing and written nowhere:

- NO CHART SHIPS allowedNamespaces PRE-FILLED. A chart naming mc-router or
  stalwart in its defaults would bake in an assumption about this cluster's
  namespace layout, which a chart cannot keep true. Restrictive is the default
  and filling it is the DEPLOYMENT adaptation - so the release-side one-liners
  this sweep produces are the expected procedure, not a defect list, and the
  major on each chart is what announces them. ingressController is the one
  exception, because it names a cluster component rather than a tenant.
- A POLICY APPLIES TO TRAFFIC THAT CAME THROUGH A SERVICE, and that is why the
  ingressController rule works at all. A Service is only destination NAT and
  the policy acts at the pod's interface. What the Service changes is the
  SOURCE ADDRESS: pod -> ClusterIP -> pod preserves it, so a podSelector can
  still match Traefik; NodePort traffic with the default externalTrafficPolicy:
  Cluster is masqueraded to a node, which is why those rules are left open.
  stalwart's template already carried the second half; the first half is the
  one everything rests on.
- AND THE ONE CLUSTER SETTING THIS CONVENTION DEPENDS ON AND CANNOT CHECK:
  Traefik must not run with hostNetwork. Measured 2026-10-14 - the DaemonSet
  has none and its pods carry real pod IPs (10.42.3.120, 10.42.4.94,
  10.42.0.187 in the pod CIDR 10.42.0.0/16, nodes on entirely different
  addresses), and only because of that does a podSelector match it. On host
  networking those pods share the node's namespace, stop being selectable,
  and EVERY WEB CHART GOES DARK AT ONCE while every pod stays Ready, because
  the probe path does not run through the controller. Same class as
  --enable-certificate-owner-ref in #126: undetectable from here. It is in
  README and in the header of template-chart's policy, so whoever changes the
  controller's networking meets the consequence on the thing they are changing.

Part of #5

template-chart/templates/xxx.networkpolicy.yaml

@@ -52,6 +52,37 @@ chart rather than quietly assumed:
      (Canal, 6/6) and for the CI cluster (k3d, which brings k3s' own policy
      controller) - verify it rather than reading it off a value.
 
+ONE CLUSTER SETTING THIS WHOLE CONVENTION DEPENDS ON AND CANNOT CHECK:
+TRAEFIK MUST NOT RUN WITH hostNetwork.
+
+Measured on 2026-10-14: the rke2-traefik DaemonSet has no hostNetwork, and its
+pods carry real pod IPs (10.42.3.120, 10.42.4.94, 10.42.0.187; the pod CIDR is
+10.42.0.0/16, while the nodes sit on entirely different addresses). ONLY
+BECAUSE OF THAT does the podSelector in networkPolicy.ingressController match
+it.
+
+Switch the ingress controller to host networking and its pods share the node's
+network namespace. They are then not selectable as pods at all, the
+ingressController entry matches nothing, and EVERY WEB CHART IN THIS REPOSITORY
+GOES DARK AT ONCE in the restricted configuration - while every policy is
+still accepted and still reads as correct. The symptom to recognise is exactly
+that shape: all web traffic stops together and every pod stays Ready, because
+the probe path does not run through the controller.
+
+Nothing here can detect this and nothing here can fail usefully on it, which is
+the same class of dependency as --enable-certificate-owner-ref in #126. It is
+written here, on the thing that depends on it, so whoever changes the
+controller's networking meets the consequence.
+
+AND A POLICY DOES APPLY TO TRAFFIC THAT CAME THROUGH A SERVICE, which is why
+the ingressController rule works in the first place. A Service is only
+destination NAT, and the policy is evaluated at the pod's interface, so a
+ClusterIP exempts nothing. What the Service changes is the SOURCE ADDRESS: pod
+-> ClusterIP -> pod PRESERVES it, so a podSelector or a namespaceSelector can
+still match the sender. Traffic arriving from outside through a NodePort with
+the default externalTrafficPolicy: Cluster is MASQUERADED to a node, which is
+why such rules cannot be restricted by source at all and are left open instead.
+
 THE PORT NUMBERS HERE ARE POD PORTS, NEVER NODEPORTS. A NetworkPolicy is
 evaluated at the POD's network interface, after kube-proxy has already
 translated a NodePort to the targetPort. Writing 30080 where the pod listens