fix(vpn): PIA strong encryption preset (RSA-4096/AES-256-CBC/SHA256, port 1197)

Operator's working config is sweden.privacy.network:1197 with RSA-4096, AES-256-CBC,
SHA256 = PIA's 'strong' preset. gluetun defaults PIA to 'normal' (AES-128-GCM), a
cipher mismatch against the 1197 (strong) endpoint, so the handshake never completed
(silent after UDP link). PIA_ENCRYPTION_PRESET=strong matches it and selects 1197.
Reverts the 8080 port red herring.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

platform/vpn-egress/gluetun-gateway.yaml

@@ -53,10 +53,11 @@ spec:
               value: "private internet access"
             - name: VPN_TYPE
               value: "openvpn"               # OpenVPN-UDP — satisfies "protocol != TCP" (R-NET); ADR-0013 amended
-            - name: OPENVPN_ENDPOINT_PORT
-              value: "8080"                  # NOT 1197: with live servers, PIA's replies FROM src-port 1197 get
-                                             # no return here — the home OpenVPN server / port-forward on 1197
-                                             # appears to swallow them. 8080 avoids that (PIA serves it too).
+            - name: PIA_ENCRYPTION_PRESET
+              value: "strong"                # operator's working .ovpn (sweden.privacy.network:1197) uses PIA's
+                                             # STRONG preset: RSA-4096 + AES-256-CBC + SHA256. gluetun defaults
+                                             # to "normal" (AES-128-GCM) → cipher mismatch, so the 1197 endpoint
+                                             # never completes the handshake. "strong" also selects port 1197.
             # Fresh server list comes from the update-servers initContainer (see above). UPDATER_PERIOD then
             # keeps it fresh for long-running pods (gluetun docs: >=360h to be nice to the provider API):
             - name: UPDATER_PERIOD