Update patchmon to 2.1.3

Chart rewrite for the 2.x single-server architecture: one stateless
server deployment (frontend embedded, /api served by the same process),
no PVC, single service and ingress path, optional guacd sidecar
(disabled by default), 2.x env vocabulary (TRUST_PROXY, readonly role),
probes send the public hostname as Host header.

Fixes #29: all three reported spots (PVC storageClass guard, RWX assets
PVC, frontend nginx 'backend' hostname) are removed by this rewrite.

ci/patchmon/fixtures.yaml

@@ -1,77 +1,7 @@
 # Fixtures for the patchmon install-test: throwaway postgres + redis, a dex
-# OIDC provider, the secrets the 1Password operator would otherwise
-# materialize (release name: ci), a pre-bound world-writable hostPath PV for
-# the assets volume (the non-root backend writes agent assets at boot;
-# hostPath does not support fsGroup), and a Service alias "backend": the
-# frontend image's nginx template resolves an upstream host literally named
-# "backend" at startup (found during the probes verification of PR #21).
-apiVersion: storage.k8s.io/v1
-kind: StorageClass
-metadata:
-  name: ci-static
-provisioner: kubernetes.io/no-provisioner
----
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: node-setup
-spec:
-  backoffLimit: 2
-  template:
-    spec:
-      restartPolicy: Never
-      containers:
-        - name: setup
-          image: public.ecr.aws/docker/library/busybox:1.36
-          command:
-            - sh
-            - -c
-            - >
-              mkdir -p /pv/patchmon/patchmon-assets /pv/patchmon/patchmon-agents &&
-              chmod -R 0777 /pv/patchmon
-          volumeMounts:
-            - name: pv
-              mountPath: /pv
-      volumes:
-        - name: pv
-          hostPath:
-            path: /var/lib/ci-pv
-            type: DirectoryOrCreate
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: ci-patchmon-data
-spec:
-  capacity:
-    storage: 10Gi
-  accessModes:
-    # The assets PVC is shared by backend and frontend as ReadWriteMany.
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: ci-static
-  claimRef:
-    namespace: default
-    name: ci-patchmon-pvc
-  hostPath:
-    path: /var/lib/ci-pv/patchmon
-    type: DirectoryOrCreate
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: backend
-spec:
-  selector:
-    app: ci-patchmon-backend
-  ports:
-    - name: http
-      port: 80
-      targetPort: 3001
-    - name: direct
-      port: 3001
-      targetPort: 3001
----
+# OIDC provider, and the secrets the 1Password operator would otherwise
+# materialize (release name: ci). The 2.x server is a single stateless
+# container, so no PV/StorageClass fixtures and no service aliases are needed.
 apiVersion: v1
 kind: Secret
 metadata: