Calibre-Web-Automated chart: naming scheme, security hardening (conventions batch 3)

All audit findings for the calibre-web-automated chart (#32) in one major
bump, 3.1.1+upv4.0.6 -> 4.0.0+upv4.0.6:

- Rename StatefulSet, Service, OnePasswordItem secret and Ingress from the
  inverted <chart>-<release>-cwa-<kind> scheme to
  <release>-<chart>-<kind>; spec.serviceName and all references follow.
  Both PVCs deliberately keep their historical names (documented naming
  exception; renaming would orphan the data).
- TLS secret renamed to the standard tls-<release>-<chart>-ingress.
- Ingress on the repo standard: ingress.className (default nginx),
  ingress.annotations merged with the chart-managed annotations,
  ingress.clusterIssuer now required (was silently defaulted to
  "letsencrypt-issuer").
- Security hardening, values-configurable via securityContext.pod /
  securityContext.container: allowPrivilegeEscalation false, all
  capabilities dropped except the minimal set the s6-overlay init needs
  (CHOWN, DAC_OVERRIDE, FOWNER, KILL, SETGID, SETUID). Documented
  deviations: the image must start as root (s6 drops to PUID 1000) and
  readOnlyRootFilesystem stays false (read-only mode disables PUID/PGID
  remapping upstream and breaks the ImageMagick policy setup).
- Additive env value rendered through tpl (value / secretKeyRef /
  configMapKeyRef forms).
- CI fixtures: secret renamed to the new scheme, clusterIssuer added to
  test-values.

Part of #32.

ci/calibre-web-automated/fixtures.yaml

@@ -1,7 +1,9 @@
 # Fixtures for the calibre-web-automated install-test: the cwa secret the
 # 1Password operator would otherwise materialize and static hostPath PVs
 # (the consume PVC is ReadWriteMany, which local-path cannot provision).
-# This chart names resources <chart>-<release>-..., release name is ci.
+# Release name is ci; resources are named <release>-<chart>-..., except the
+# PVCs, which keep their historical <chart>-<release>-cwa-* names
+# (documented naming exception, see README).
 apiVersion: storage.k8s.io/v1
 kind: StorageClass
 metadata:
@@ -74,7 +76,7 @@ spec:
 apiVersion: v1
 kind: Secret
 metadata:
-  name: calibre-web-automated-ci-cwa-secret
+  name: ci-calibre-web-automated-secret
 stringData:
   hardcover-api-token: ci-dummy-token
   # Mounted as /config/.config/calibre/customize.py.json (calibre plugin

ci/calibre-web-automated/test-values.yaml

@@ -9,4 +9,5 @@ cwa:
   storage: 2Gi
 
 ingress:
+  clusterIssuer: ci
   domain: cwa.ci.local