fix(vpn): shrink OpenVPN tun-mtu/mssfix to 1350 (Cilium VXLAN pod MTU 1450)

Actual root cause (operator-directed layered MTU check): Cilium runs VXLAN
(routing-mode tunnel) so pods get MTU 1450 (1500-50 encap) while node, hypervisor,
and the Google Fiber WAN are all 1500. OpenVPN's ~1500-byte handshake packets
exceed 1450 and are dropped (PMTUD broken). The ports were a red herring.

Fix: OPENVPN_MTU=1350 + OPENVPN_MSSFIX=1350 so encrypted packets (~1402) fit under
1450. Keeps OpenVPN + VXLAN unchanged. Re-enable vpn-egress. Full layered trace
(pod/node/host) in DECISIONS-LOG.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

DECISIONS-LOG.md

@@ -544,3 +544,19 @@ small fixed-size packets → **not MTU-sensitive** like OpenVPN's TLS handshake,
 Gluetun's control API — matters only when qBittorrent/natmap is built (Phase 6), not now. `vpn-egress`
 disabled meanwhile (crashloop would fire false alerts). Awaiting operator's architect decision before the
 container swap.
+
+### Phase 3 VPN — ACTUAL root cause: Cilium VXLAN pod MTU (2026-08-22)
+Operator (correctly) rejected the port theory (client uses ephemeral src ports; dest port is irrelevant to
+return traffic) and had me check MTU at each layer. Findings via `ping -M do` sweeps:
+- **Pod** → internet: MTU 1450 OK, 1470 DROP (silent). Pod `eth0` shows 1500 but the effective route is 1450.
+- **Node** (k3s-dev-3) → internet: **1500 OK**. All node ifaces (ens3, cilium_*, lxc*) = 1500.
+- **Hypervisor** → internet: **1500 OK**. (Google Fiber SOHO router hands off full 1500 — not the culprit.)
+- Cilium config: **`routing-mode: tunnel`, `tunnel-protocol: vxlan`** → Cilium subtracts the 50-byte VXLAN
+  overhead → **pod MTU 1450**. OpenVPN emits ~1500-byte handshake packets → exceed 1450 → dropped (broken
+  PMTUD = no ICMP back). This is why HTTPS (MSS-clamped) + small UDP (DNS/NTP) work but OpenVPN doesn't.
+
+**Fix (operator's choice: "shrink OpenVPN MTU in gluetun"):** set gluetun `OPENVPN_MTU=1350` (tun-mtu) and
+`OPENVPN_MSSFIX=1350` so encrypted packets (~1350+52 ≈ 1402) fit under the 1450 pod MTU. Keeps OpenVPN +
+Cilium VXLAN unchanged. Port kept at 8080 (confirmed PIA responds). Re-enabled `vpn-egress`. Values hardcoded
+as quoted strings (int-coercion gotcha). Alternatives not taken: Cilium native routing (pod MTU→1500) or
+WireGuard/thrnz (MTU-robust) — both still available if the MTU shrink proves insufficient.