fix(vpn): enable gluetun server-list updater (bundled list was stale) + re-enable

CORRECTION: the connection failures were gluetun dialing RETIRED PIA IPs (46.246.x
= dead → timeouts, which I mis-read as a network block). A fresh PIA .ovpn connects
from the same host, and PIA's current SE Stockholm servers (158.173.x) are reachable.
Cilium was independently cleared (default-allow, host-fw off, Hubble FORWARDED).

Fix: UPDATER_PERIOD=24h so gluetun fetches PIA's current servers; keep
OPENVPN_MTU/MSSFIX=1350 for the real Cilium-VXLAN 1450 pod MTU (data channel);
PIA default UDP port. Re-enable vpn-egress. Full correction in DECISIONS-LOG.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

DECISIONS-LOG.md

@@ -581,3 +581,18 @@ WireGuard/thrnz would NOT help — same PIA IPs are blocked; if switching provid
 one whose ranges this network permits. Reverted the port/MTU red-herring env from gluetun-gateway.yaml
 (back to PIA defaults); `vpn-egress` disabled so it doesn't crashloop/alert. **Config is correct and
 complete — the only blocker is the network.**
+
+### Phase 3 VPN — CORRECTION: it was gluetun's STALE server list, NOT a network block (2026-08-22)
+The "network blackholes PIA" conclusion above was WRONG. The operator installed a fresh PIA `.ovpn` in GNOME
+on the same host/network and it connected fine → the network permits PIA. Verified against PIA's live server
+list: current SE Stockholm servers are **158.173.241.x** and ARE reachable (tcp/8080 → RST / "connection
+refused" = the server answered). The IPs gluetun was dialing (**46.246.x / 212.112.x**) are **retired**
+(timeout = dead hosts). So gluetun's **bundled server list was stale**, and my host reachability test used
+those dead IPs → false "blackhole." (Cilium was independently ruled out per the operator's request: policy
+mode `default` = default-allow, host firewall disabled, no policy selects these pods, and Hubble showed
+pod→PIA `to-network FORWARDED`, no drops.)
+
+**Fix:** gluetun `UPDATER_PERIOD=24h` (fetch PIA's current server list at startup); keep `OPENVPN_MTU=1350`
++ `OPENVPN_MSSFIX=1350` for the real Cilium-VXLAN 1450 pod MTU (data channel); PIA default OpenVPN UDP port.
+Re-enabled `vpn-egress`. **Lesson:** when gluetun "can't reach" a provider, suspect a stale bundled server
+list FIRST — validate against the provider's live server list before blaming the network/MTU/ports.