fix(vpn): narrow FIREWALL_OUTBOUND_SUBNETS to 10.0.0.0/16 (PF gateway overlap)

PIA's PF gateway 10.31.128.1 sits inside the /8 cluster-pool, so
FIREWALL_OUTBOUND_SUBNETS=10.0.0.0/8 made gluetun route it around the tunnel and
port forwarding timed out (getSignature to 10.31.128.1:19999). /16 covers actual
pod allocations and excludes PIA's 10.31.x.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

clusters/base/cluster-vars.yaml

@@ -41,8 +41,11 @@ data:
   PIA_REGION: "SE Stockholm"                 # operator's choice (Sweden). PIA's OpenVPN region name is
                                              # "SE Stockholm" — PF-capable (NOT "SE Streaming Optimized",
                                              # which lacks PF; NOT a US region, which also lack PF)
-  CLUSTER_POD_CIDR: "10.0.0.0/8"             # Cilium cluster-pool pod CIDR (pods get 10.x); Gluetun
-                                             # FIREWALL_OUTBOUND_SUBNETS = allow these to egress via the tunnel
+  CLUSTER_POD_CIDR: "10.0.0.0/16"            # Gluetun FIREWALL_OUTBOUND_SUBNETS (bypass for steered client pods).
+                                             # NARROWED from the /8 cluster-pool: /8 overlaps PIA's tunnel gateway
+                                             # 10.31.128.1, so gluetun routed PIA's own PF gateway AROUND the tunnel
+                                             # → port forwarding timed out. /16 covers actual pod allocations
+                                             # (Cilium assigns /24 per node from 10.0.0.0 up) and excludes 10.31.x.
   # NOTE: Phase-3 VPN uses PIA's default OpenVPN UDP port + gluetun's server-list UPDATER (the bundled list
   # was stale, dialing retired IPs). Port/region are not cluster-vars (see gluetun-gateway.yaml). See DECISIONS-LOG.