fix(vpn): default PIA_REGION to Sweden (operator choice, PF-capable)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

platform/vpn-egress/README.md

@@ -19,8 +19,8 @@ tunnel; `internet`-class services go out the normal WAN. Serves **R-NET-05/06/07
 2. cluster-vars (already defined in `clusters/base/cluster-vars.yaml`; a ConfigMap — values are plain
    strings under `data:`, injected into the `${...}` tokens by Flux `postBuild.substituteFrom`). Confirm
    or override:
-   - `PIA_REGION` — a **port-forwarding-capable** PIA region (default `Netherlands`; e.g. `CA Toronto`,
-     `Switzerland`; NOT a US region — those lack PF). Gluetun `SERVER_REGIONS`.
+   - `PIA_REGION` — a **port-forwarding-capable** PIA region (default `Sweden`; e.g. `Netherlands`,
+     `CA Toronto`, `Switzerland`; NOT a US region — those lack PF). Gluetun `SERVER_REGIONS`.
    - `CLUSTER_POD_CIDR` — the **Cilium cluster-pool** pod CIDR (default `10.0.0.0/8`; pods get `10.x`,
      confirmed live — NOT the k3s `10.42.0.0/16`). Gluetun `FIREWALL_OUTBOUND_SUBNETS`.
    Per-env overrides go in `clusters/<env>/kustomization.yaml` as a cluster-vars JSON patch