fix(vpn): default PIA_REGION to Sweden (operator choice, PF-capable)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

clusters/base/cluster-vars.yaml

@@ -38,8 +38,8 @@ data:
   KYVERNO_ADMISSION_REPLICAS: "3"                 # dev: 1 (no HA needed to iterate)
 
   # --- egress / VPN (Phase 3, ADR-0013) — consumed by platform/vpn-egress/gluetun-gateway.yaml ---
-  PIA_REGION: "Netherlands"                  # a PORT-FORWARDING-capable PIA region (NOT a US region);
-                                             # operator: change to your preferred PF-capable region
+  PIA_REGION: "Sweden"                       # operator's choice — a PORT-FORWARDING-capable PIA region
+                                             # (Sweden is PF-capable; NOT a US region, which lack PF)
   CLUSTER_POD_CIDR: "10.0.0.0/8"             # Cilium cluster-pool pod CIDR (pods get 10.x); Gluetun
                                              # FIREWALL_OUTBOUND_SUBNETS = allow these to egress via the tunnel