fix(vpn): valid OpenVPN flags only (--hand-window 120; --tls-mtu invalid in 2.6)

OpenVPN 2.6.16 rejects --tls-mtu (not a real option) and PIA doesn't support
--fragment, so control-channel packets can't be shrunk. Keep --hand-window 120 to
give the RSA-4096 handshake more time over a lossy/marginal path, plus tun-mtu 1300.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

platform/vpn-egress/gluetun-gateway.yaml

@@ -70,9 +70,9 @@ spec:
             - name: OPENVPN_MSSFIX
               value: "1300"                  # clamp TCP-in-tunnel to match
             - name: OPENVPN_FLAGS
-              value: "--tls-mtu 1200 --hand-window 120"   # shrink the CONTROL-channel packets (RSA-4096 strong
-                                             # preset handshake) so they fit reliably under 1450, and give the
-                                             # handshake longer than the default 60s to complete over a lossy path.
+              value: "--hand-window 120"     # OpenVPN 2.6 has no control-channel MTU option (--tls-mtu is
+                                             # invalid) and PIA doesn't support --fragment; so just give the
+                                             # RSA-4096 handshake 120s (vs 60s default) to complete over loss.
             # PIA credentials from the SOPS secret (Gluetun's PIA OpenVPN creds env):
             - name: OPENVPN_USER
               valueFrom: