fix(vpn): map .ovpn secret key (filename) to /config/pia.ovpn

Operator's kubectl create secret keyed the file by its name
(sweden-aes-128-cbc-udp-dns.ovpn); mount item now references that key -> pia.ovpn.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

platform/vpn-egress/gluetun-gateway.yaml

@@ -101,7 +101,8 @@ spec:
           secret:
             secretName: pia-custom-ovpn
             items:
-              - key: pia.ovpn
+              # the operator's secret keyed the .ovpn by its filename; map it to /config/pia.ovpn
+              - key: sweden-aes-128-cbc-udp-dns.ovpn
                 path: pia.ovpn
 ---
 # Control API Service — used for tunnel-state health/alerting (ADR-0013 "alert on tunnel state").