Merge feature/pia-region-fix into main

clusters/base/cluster-vars.yaml

@@ -38,8 +38,9 @@ data:
   KYVERNO_ADMISSION_REPLICAS: "3"                 # dev: 1 (no HA needed to iterate)
 
   # --- egress / VPN (Phase 3, ADR-0013) — consumed by platform/vpn-egress/gluetun-gateway.yaml ---
-  PIA_REGION: "Sweden"                       # operator's choice — a PORT-FORWARDING-capable PIA region
-                                             # (Sweden is PF-capable; NOT a US region, which lack PF)
+  PIA_REGION: "SE Stockholm"                 # operator's choice (Sweden). PIA's OpenVPN region name is
+                                             # "SE Stockholm" — PF-capable (NOT "SE Streaming Optimized",
+                                             # which lacks PF; NOT a US region, which also lack PF)
   CLUSTER_POD_CIDR: "10.0.0.0/8"             # Cilium cluster-pool pod CIDR (pods get 10.x); Gluetun
                                              # FIREWALL_OUTBOUND_SUBNETS = allow these to egress via the tunnel