fix(vpn): hardcode OPENVPN_ENDPOINT_PORT "53" as string (Flux var int-coercion)

Wiring the port via "${PIA_OPENVPN_PORT}" made Flux/kustomize emit an unquoted
53 (int) after substitution, which k8s rejects for an env value ("expected
string, got 53"). Same gotcha as the Longhorn numberOfReplicas fix. Hardcode the
quoted string; cluster-var removed with a NOTE explaining why.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

platform/kustomization.yaml

@@ -17,7 +17,7 @@ resources:
   - cert-manager       # Let's Encrypt DNS-01 wildcard — needs SOPS `cloudflare-api-token`
   - externaldns        # auto DNS records — needs SOPS `cloudflare-api-token`
   - gateway            # Gateway API listeners (ingress; replaces Traefik)
-  # ---- Phase 3 — Egress / VPN (PIA OpenVPN-UDP on port ${PIA_OPENVPN_PORT}=53, ADR-0013 amendment).
+  # ---- Phase 3 — Egress / VPN (PIA OpenVPN-UDP on port 53, ADR-0013 amendment).
   #      NOT PIA's default 1197 — this home network NATs its own OpenVPN server on WAN:1197, which
   #      collided with the outbound PIA-on-1197 flow (tcpdump-confirmed; DECISIONS-LOG). ----
   - vpn-egress         # shared Gluetun PIA/OpenVPN-UDP egress gateway + kill-switch (ADR-0013)

platform/vpn-egress/gluetun-gateway.yaml

@@ -41,8 +41,11 @@ spec:
             - name: VPN_TYPE
               value: "openvpn"               # OpenVPN-UDP — satisfies "protocol != TCP" (R-NET); ADR-0013 amended
             - name: OPENVPN_ENDPOINT_PORT
-              value: "${PIA_OPENVPN_PORT}"   # NOT 1197 — the home network NATs its own OpenVPN server there,
-                                             # so PIA-on-1197 replies never return (see cluster-vars + DECISIONS-LOG)
+              value: "53"                    # NOT 1197 — the home network NATs its own OpenVPN server there,
+                                             # so PIA-on-1197 replies never return (tcpdump-confirmed; DECISIONS-LOG).
+                                             # Hardcoded (not a ${var}): Flux/kustomize strips quotes on "${VAR}"
+                                             # → int coercion, which k8s rejects for env value (Longhorn-fix gotcha).
+                                             # Valid PIA ports: 53, 1194, 1197, 1198, 8080, 9201.
             # PIA credentials from the SOPS secret (Gluetun's PIA OpenVPN creds env):
             - name: OPENVPN_USER
               valueFrom: