fix(vpn): hardcode OPENVPN_ENDPOINT_PORT "53" as string (Flux var int-coercion)

Wiring the port via "${PIA_OPENVPN_PORT}" made Flux/kustomize emit an unquoted
53 (int) after substitution, which k8s rejects for an env value ("expected
string, got 53"). Same gotcha as the Longhorn numberOfReplicas fix. Hardcode the
quoted string; cluster-var removed with a NOTE explaining why.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

platform/vpn-egress/gluetun-gateway.yaml

@@ -41,8 +41,11 @@ spec:
             - name: VPN_TYPE
               value: "openvpn"               # OpenVPN-UDP — satisfies "protocol != TCP" (R-NET); ADR-0013 amended
             - name: OPENVPN_ENDPOINT_PORT
-              value: "${PIA_OPENVPN_PORT}"   # NOT 1197 — the home network NATs its own OpenVPN server there,
-                                             # so PIA-on-1197 replies never return (see cluster-vars + DECISIONS-LOG)
+              value: "53"                    # NOT 1197 — the home network NATs its own OpenVPN server there,
+                                             # so PIA-on-1197 replies never return (tcpdump-confirmed; DECISIONS-LOG).
+                                             # Hardcoded (not a ${var}): Flux/kustomize strips quotes on "${VAR}"
+                                             # → int coercion, which k8s rejects for env value (Longhorn-fix gotcha).
+                                             # Valid PIA ports: 53, 1194, 1197, 1198, 8080, 9201.
             # PIA credentials from the SOPS secret (Gluetun's PIA OpenVPN creds env):
             - name: OPENVPN_USER
               valueFrom: