voucher-vault: strict values.schema.json and null-safe hardening

No ingress gate: this chart already gates its Ingress correctly. Two
changes plus one guard that the existing gate turned out to need.

1. values.schema.json (#68): additionalProperties: false on every
   chart-owned object level. Lists that go verbatim into the pod spec
   (ports, storage.volumes, storage.volumeMounts) stay open.

2. Null-safety for hardening, probes and resources (#99). Two specifics
   of this chart:

   - The probes were wrapped in "if" guards, so an erased probe block did
     not render "livenessProbe: null" - it removed the probe entirely and
     silently. The guards are gone; an empty block now means chart
     defaults, so the workload keeps its probes.
   - The rebuilt probes keep the Host: 127.0.0.1 header. Django's
     ALLOWED_HOSTS only accepts 127.0.0.1 and the configured DOMAIN, so a
     probe without it would get 400 and the pod would never be ready.

3. ingress.domain is required() where it is read. The dependency lives in
   values.yaml, not in a template: the DOMAIN env entry is a tpl string
   feeding Django's ALLOWED_HOSTS. With the existing gate and no domain
   the app rendered DOMAIN: "" and answered 400 to every real request -
   silently, and already before this change. It now fails loudly.

Apart from an added comment, the rendered manifest is unchanged.

voucher-vault/templates/voucher-vault.sfs.yaml

@@ -18,7 +18,7 @@ spec:
     spec:
       automountServiceAccountToken: false
       securityContext:
-        {{- toYaml .Values.voucherVault.securityContext.pod | nindent 8 }}
+        {{- include "voucher-vault.podSecurityContext" .Values.voucherVault.securityContext | nindent 8 }}
       initContainers:
         # STATIC_ROOT (/opt/app/myapp/static) doubles as the app's own static
         # source directory, so it cannot simply be shadowed by an empty
@@ -33,7 +33,7 @@ spec:
           # on the mountpoint itself, which the non-root uid may not own.
           command: ["sh", "-c", "cp -a /opt/app/myapp/static/* /static-seed/"]
           securityContext:
-            {{- toYaml .Values.voucherVault.securityContext.container | nindent 12 }}
+            {{- include "voucher-vault.containerSecurityContext" .Values.voucherVault.securityContext | nindent 12 }}
           volumeMounts:
             - name: static-files
               mountPath: /static-seed
@@ -73,22 +73,19 @@ spec:
             {{- end }}
           ports:
             {{- toYaml .Values.voucherVault.ports | nindent 12 }}
-          {{- if .Values.voucherVault.livenessProbe }}
+          # No "if" guards here any more: an erased probe block used to omit the
+          # probe entirely and silently. It now falls back to the chart
+          # defaults (#99), so the workload keeps its probes.
           livenessProbe:
-            {{- toYaml .Values.voucherVault.livenessProbe | nindent 12 }}
-          {{- end }}
-          {{- if .Values.voucherVault.readinessProbe }}
+            {{- include "voucher-vault.livenessProbe" .Values.voucherVault.livenessProbe | nindent 12 }}
           readinessProbe:
-            {{- toYaml .Values.voucherVault.readinessProbe | nindent 12 }}
-          {{- end }}
-          {{- if .Values.voucherVault.startupProbe }}
+            {{- include "voucher-vault.readinessProbe" .Values.voucherVault.readinessProbe | nindent 12 }}
           startupProbe:
-            {{- toYaml .Values.voucherVault.startupProbe | nindent 12 }}
-          {{- end }}
+            {{- include "voucher-vault.startupProbe" .Values.voucherVault.startupProbe | nindent 12 }}
           resources:
-            {{- include "voucher-vault.resources" .Values.voucherVault.resources | nindent 12 }}
+            {{- include "voucher-vault.effectiveResources" .Values.voucherVault.resources | nindent 12 }}
           securityContext:
-            {{- toYaml .Values.voucherVault.securityContext.container | nindent 12 }}
+            {{- include "voucher-vault.containerSecurityContext" .Values.voucherVault.securityContext | nindent 12 }}
           volumeMounts:
             # Writable emptyDirs over the paths the image writes at runtime,
             # so the root filesystem can stay read-only (see securityContext