tune(vpn): shrink OpenVPN control-channel MTU + widen handshake window

RSA-4096 strong-preset handshake is marginal over the pod's 1450 MTU (Cilium VXLAN).
Lower tun-mtu to 1300 and add --tls-mtu 1200 (smaller control packets) + --hand-window
120 (more time to complete the handshake over a lossy path). Empirical test of the
MTU-tuning path (operator's choice over Cilium native routing).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

platform/vpn-egress/gluetun-gateway.yaml

@@ -66,9 +66,13 @@ spec:
             # DATA-channel packets fit (the handshake is small so this wasn't the connect blocker, but the
             # data channel needs it). Hardcoded strings (int-coercion gotcha). See DECISIONS-LOG.
             - name: OPENVPN_MTU
-              value: "1350"
+              value: "1300"                  # tun-mtu: extra margin under the 1450 pod MTU (data channel)
             - name: OPENVPN_MSSFIX
-              value: "1350"
+              value: "1300"                  # clamp TCP-in-tunnel to match
+            - name: OPENVPN_FLAGS
+              value: "--tls-mtu 1200 --hand-window 120"   # shrink the CONTROL-channel packets (RSA-4096 strong
+                                             # preset handshake) so they fit reliably under 1450, and give the
+                                             # handshake longer than the default 60s to complete over a lossy path.
             # PIA credentials from the SOPS secret (Gluetun's PIA OpenVPN creds env):
             - name: OPENVPN_USER
               valueFrom: