feat(vpn): enable vpn-egress on OpenVPN-UDP; align docs to ADR-0013 amendment

Gluetun cannot do PIA over WireGuard (upstream unsupported; live "provider name
is not valid for Wireguard"). Operator approved OpenVPN-UDP and ADR-0013 was
amended in the spec. This aligns the impl:

- platform/kustomization.yaml: re-enable `- vpn-egress` (Phase 3, OpenVPN-UDP)
- gluetun-gateway.yaml: clean stale WireGuard comments (header, image note,
  VPN_TYPE/creds comments); config already VPN_TYPE=openvpn
- README.md: PIA-over-OpenVPN, status=enabled, steering iface wg0 -> tun0
- DECISIONS-LOG.md: disk/drive incident (k3s -> NVMe; failing Seagate) + Phase-3
  OpenVPN resolution

Stale WireGuard comments inside the operator's encrypted pia-credentials.sops.yaml
header left untouched (editing breaks the SOPS MAC; cosmetic).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

DECISIONS-LOG.md

@@ -446,3 +446,41 @@ Job (ADR-0011) already uses the pinned image. Deferred (non-blocking).
 - **T-3.2p** PIA username/password → VPN egress gateway (Phase 3).
 - **OQ-BKP** off-cluster backup target → Velero (Phase 4).
 - SMTP creds → Alertmanager email (Phase 4).
+
+## Disk/drive incident + k3s relocated to NVMe (2026-08-22)
+**Trigger:** host root fs (Kingston SSD `/dev/sdb3`, btrfs) hit ~99% (<1GB); the system paused the k3s
+VMs on I/O error. Operator asked to move the VM disks off root to a larger drive.
+
+**Why root filled:** the k3s VM disks lived under the snapper-snapshotted root subvolume; high VM-disk
+churn multiplied across hourly snapshots. Freed by deleting the 11 `Snapper` timeline snapshots +
+`virsh destroy`-ing the paused VMs (which held the old, rsync-unlinked inodes open) → btrfs reclaim.
+Root 99% → 30% (326G free).
+
+**F-DISK1 — the Seagate 4TB HDD is FAILING.** First relocated the VM disks to the HDD (`/mnt/seagate`);
+etcd then hit **48% iowait + constant "apply took too long"**, pods drifted to Unknown, never converged.
+SMART on `/dev/sda` (ST4000DM000): **29,408 reallocated, 448 current-pending + 448 offline-uncorrectable**,
+~25k power-on hrs. A dying drive, not "HDD is slow." Do NOT use for etcd/critical data.
+
+**Resolution:** k3s disks moved to the **WD_BLACK SN770 NVMe** (`/dev/nvme0n1p3`, `/mnt/games`) in a
+dedicated btrfs subvol `/mnt/games/libvirt-k3s` (nodatacow), **bind-mounted to `/var/lib/libvirt/images`**
+so tofu/libvirt paths + the qcow2 backing chain are unchanged (no IaC edits). etcd iowait → 0%, cluster
+fully converged (64 Running). fstab updated; SELinux relabeled. Archival VMs (rocky10/silverblue/win11)
+repointed to their real HDD path and LEFT on the failing drive.
+
+**Follow-ups (assumptions logged):** (1) the NVMe bind-mount is a runtime change — codify in an Ansible
+`host-prereqs` task for reproducibility; (2) redundant k3s copies remain at `/mnt/seagate/libvirt-images/k3s-dev-*`
+(safe to delete; NVMe authoritative) — left pending operator OK; (3) archival VMs on the failing HDD need
+migration + the disk replaced.
+
+## Phase 3 VPN — protocol resolved to OpenVPN-UDP; deploying (2026-08-22)
+ADR-0013 said PIA/WireGuard, but **Gluetun does not support PIA over WireGuard** (upstream: native support
+"cannot be added… slow WIP"; live error "provider name is not valid for Wireguard"). **Operator (as System
+Architect) approved OpenVPN-UDP and ADR-0013 was amended in the spec repo** (protocol only; architecture
+unchanged; `thrnz/docker-wireguard-pia` recorded as the WireGuard fallback). Impl aligned: `VPN_TYPE=openvpn`,
+`vpn-egress` ENABLED in `platform/kustomization.yaml`, stale WireGuard comments cleaned (gluetun-gateway.yaml,
+README; steering iface `wg0`→`tun0`). Pushed to Gitea → Flux reconciles the OpenVPN gateway. Stale WireGuard
+comments remain inside the operator's encrypted `pia-credentials.sops.yaml` header — left untouched (editing
+breaks the SOPS MAC); cosmetic.
+
+**Next:** confirm the OpenVPN tunnel comes up + correct egress IP, then egress-steering validation (README
+option 1, `tun0`) + kill-switch conformance (R-NET-06).