wip(vpn): gluetun custom-provider mode with operator's PIA .ovpn

PIA-provider server selection is flaky here (random dead IPs); the operator's .ovpn
uses sweden.privacy.network (load-balanced, reliable). Switch to custom mode
(VPN_SERVICE_PROVIDER=custom, OPENVPN_CUSTOM_CONFIG=/config/pia.ovpn), mount the
pia-custom-ovpn Secret, keep creds + kill-switch + tun-mtu 1300. Drops PIA-provider
server list/updater and native PF (Phase-6 concern). Pending the operator-provisioned
pia-custom-ovpn Secret (not merged until it exists).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

bootstrap/sops/secret-templates/pia-custom-ovpn.yaml.example

@@ -0,0 +1,28 @@
+# pia-custom-ovpn — the operator's PIA OpenVPN .ovpn file for gluetun custom-provider mode.
+#
+# WHY: gluetun's PIA-provider server selection random-picks server IPs, many of which don't answer
+# this cluster's flows (intermittent TLS timeouts). The downloaded PIA .ovpn targets the load-balanced
+# hostname `sweden.privacy.network`, which always lands on a healthy server (reliable on the host).
+# See DECISIONS-LOG "Phase 3 VPN — custom .ovpn".
+#
+# The .ovpn should use `auth-user-pass` (no inline creds) — gluetun injects OPENVPN_USER/OPENVPN_PASSWORD
+# from the pia-credentials Secret. It contains only the (public) CA cert + config, but we keep it in a
+# SOPS-encrypted Secret for consistency.
+#
+# PROVISION (operator runs SOPS; agents never handle secret values):
+#   1. Generate the Secret manifest straight from your .ovpn file:
+#        kubectl create secret generic pia-custom-ovpn -n vpn-egress \
+#          --from-file=pia.ovpn=/path/to/your-pia.ovpn \
+#          --dry-run=client -o yaml > platform/vpn-egress/pia-custom-ovpn.sops.yaml
+#   2. Encrypt in place (matches .sops.yaml creation_rules for *.sops.yaml):
+#        sops -e -i platform/vpn-egress/pia-custom-ovpn.sops.yaml
+#   3. Commit. Flux + the SOPS decryption provider apply it; gluetun mounts it at /config/pia.ovpn.
+#
+# The generated (pre-encryption) shape looks like:
+apiVersion: v1
+kind: Secret
+metadata:
+  name: pia-custom-ovpn
+  namespace: vpn-egress
+data:
+  pia.ovpn: <base64 of the .ovpn file>   # `kubectl create secret --from-file` fills this in for you