fix(vpn): PIA normal preset (RSA-2048/AES-128-CBC/SHA1, 1198) for MTU reliability

RSA-4096 strong handshake wouldn't hold over the pod's 1450 MTU (Cilium VXLAN);
MTU tuning is exhausted (no --tls-mtu in OpenVPN 2.6, PIA rejects --fragment).
Operator downloaded the lower-encryption PIA config (port 1198, RSA-2048,
AES-128-CBC, SHA1) = gluetun's 'normal' preset. Smaller handshake fits 1450.
Dropped the strong-handshake band-aid flags; kept OPENVPN_MTU 1300 for the data channel.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

platform/vpn-egress/gluetun-gateway.yaml

@@ -54,10 +54,10 @@ spec:
             - name: VPN_TYPE
               value: "openvpn"               # OpenVPN-UDP — satisfies "protocol != TCP" (R-NET); ADR-0013 amended
             - name: PIA_ENCRYPTION_PRESET
-              value: "strong"                # operator's working .ovpn (sweden.privacy.network:1197) uses PIA's
-                                             # STRONG preset: RSA-4096 + AES-256-CBC + SHA256. gluetun defaults
-                                             # to "normal" (AES-128-GCM) → cipher mismatch, so the 1197 endpoint
-                                             # never completes the handshake. "strong" also selects port 1197.
+              value: "normal"                # PIA "normal": RSA-2048 + AES-128-CBC + SHA1, port 1198 (matches the
+                                             # operator's downloaded lower-encryption .ovpn). Chosen over "strong"
+                                             # (RSA-4096): the smaller handshake fits the pod's 1450 MTU (Cilium
+                                             # VXLAN) reliably, where RSA-4096 was marginal and wouldn't hold.
             # Fresh server list comes from the update-servers initContainer (see above). UPDATER_PERIOD then
             # keeps it fresh for long-running pods (gluetun docs: >=360h to be nice to the provider API):
             - name: UPDATER_PERIOD
@@ -69,10 +69,6 @@ spec:
               value: "1300"                  # tun-mtu: extra margin under the 1450 pod MTU (data channel)
             - name: OPENVPN_MSSFIX
               value: "1300"                  # clamp TCP-in-tunnel to match
-            - name: OPENVPN_FLAGS
-              value: "--hand-window 120 --mtu-disc no"   # --mtu-disc no clears the DF bit so oversized RSA-4096
-                                             # handshake packets FRAGMENT through the 1450 pod MTU instead of being
-                                             # silently dropped; --hand-window 120 gives the handshake more time.
             # PIA credentials from the SOPS secret (Gluetun's PIA OpenVPN creds env):
             - name: OPENVPN_USER
               valueFrom: