feat(phase3): author shared VPN egress gateway (Gluetun/PIA/WireGuard) — author-first

Per ADR-0013: platform/vpn-egress/ = a single shared Gluetun gateway (PIA over WireGuard,
built-in kill-switch FIREWALL=on, native port forwarding), namespace (non-app, NET_ADMIN +
/dev/net/tun), control-API Service, and a pre-wired (commented) pia-credentials SOPS line.
Defined the PIA secret location (platform/vpn-egress, keys username/password → OPENVPN_USER/
OPENVPN_PASSWORD) and updated the SOPS template accordingly.

NOT wired into platform/kustomization.yaml (Phase 3, author-first) — deploy needs PIA creds +
validation of the egress-steering mechanism (Cilium Egress Gateway → the Gluetun node's wg0;
documented in README with options + a fail-closed rationale, deliberately NOT committed as an
untested CiliumEgressGatewayPolicy). WireGuard chosen (UDP, protocol != TCP); PIA supports it on
all regions and the secret stays username/password.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

bootstrap/sops/secret-templates/pia-credentials.yaml.example

@@ -2,30 +2,24 @@
 # TEMPLATE — NOT APPLIED, NOT ENCRYPTED (.yaml.example is ignored by kustomize
 # and never auto-encrypted by SOPS). Reference scaffold only.
 #
-# (a) Copy to:      (TO BE DECIDED AT PHASE 3 — VPN component not authored yet)
-# (b) kustomization: DO NOT WIRE YET.
-# (c) Encrypt:       sops -e -i <target>.sops.yaml   (once the target path exists)
-# (d) Consumed by:   Phase-3 Gluetun VPN egress gateway. The consuming
-#                    component AND its namespace DO NOT EXIST yet — this template
-#                    is provisioned upfront. [Phase 3]
-#
-# !! NAMESPACE UNKNOWN — the metadata.namespace below is a placeholder. Set it to
-#    the VPN gateway's namespace when that component is authored at Phase 3. !!
+# (a) Copy to:      platform/vpn-egress/pia-credentials.sops.yaml
+# (b) kustomization: uncomment `- pia-credentials.sops.yaml` in platform/vpn-egress/kustomization.yaml
+# (c) Encrypt:       sops -e -i platform/vpn-egress/pia-credentials.sops.yaml
+# (d) Consumed by:   the Phase-3 Gluetun VPN egress gateway (platform/vpn-egress/gluetun-gateway.yaml),
+#                    which maps username->OPENVPN_USER, password->OPENVPN_PASSWORD. [Phase 3]
 #
 # VALUE NOTES:
 #  - username: PIA (Private Internet Access) user, form pNNNNNNN.
 #  - password: PIA password.
-#  - Gluetun typically reads OPENVPN_USER / OPENVPN_PASSWORD (OpenVPN) or
-#    WireGuard credentials. Confirm the chosen protocol when wiring — the
-#    requirement says NOT TCP. The env var names / key names the Gluetun
-#    deployment expects may differ from username/password below; adjust to match
-#    the chosen protocol before encrypting.
+#  - Protocol is WireGuard (VPN_TYPE=wireguard, UDP — satisfies "not TCP"). PIA on WireGuard STILL
+#    authenticates with the username/password below (Gluetun derives the WireGuard config from PIA's
+#    API at runtime), so these two keys are correct as-is — no extra WireGuard key material needed.
 # =============================================================================
 apiVersion: v1
 kind: Secret
 metadata:
   name: pia-credentials
-  namespace: REPLACE-ME-PHASE-3-VPN-NAMESPACE
+  namespace: vpn-egress
 type: Opaque
 stringData:
   username: REPLACE-ME