fix(vpn): hardcode OPENVPN_ENDPOINT_PORT "53" as string (Flux var int-coercion)

Wiring the port via "${PIA_OPENVPN_PORT}" made Flux/kustomize emit an unquoted
53 (int) after substitution, which k8s rejects for an env value ("expected
string, got 53"). Same gotcha as the Longhorn numberOfReplicas fix. Hardcode the
quoted string; cluster-var removed with a NOTE explaining why.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

clusters/base/cluster-vars.yaml

@@ -43,11 +43,9 @@ data:
                                              # which lacks PF; NOT a US region, which also lack PF)
   CLUSTER_POD_CIDR: "10.0.0.0/8"             # Cilium cluster-pool pod CIDR (pods get 10.x); Gluetun
                                              # FIREWALL_OUTBOUND_SUBNETS = allow these to egress via the tunnel
-  PIA_OPENVPN_PORT: "53"                     # PIA OpenVPN endpoint UDP port. PIA's default is 1197, but
-                                             # this home network NATs its OWN OpenVPN server on WAN:1197, so
-                                             # outbound PIA-on-1197 replies never return (tcpdump-confirmed).
-                                             # 53 is proven to traverse this network. Valid PIA ports:
-                                             # 53, 1194, 1197, 1198, 8080, 9201. Other envs may override to 1197.
+  # NOTE: PIA OpenVPN port is HARDCODED "53" in gluetun-gateway.yaml, not a cluster-var — Flux/kustomize
+  # strips quotes around a bare "${VAR}" so a numeric value coerces to int, which k8s rejects for an env
+  # value (same gotcha as the Longhorn numberOfReplicas fix). See DECISIONS-LOG.
 
   # --- identity / auth (ADR-0014) ---
   KEYCLOAK_REPLICAS: "1"                     # dev 1 | prod 2 (HA)