fix(vpn): shrink OpenVPN tun-mtu/mssfix to 1350 (Cilium VXLAN pod MTU 1450)

Actual root cause (operator-directed layered MTU check): Cilium runs VXLAN
(routing-mode tunnel) so pods get MTU 1450 (1500-50 encap) while node, hypervisor,
and the Google Fiber WAN are all 1500. OpenVPN's ~1500-byte handshake packets
exceed 1450 and are dropped (PMTUD broken). The ports were a red herring.

Fix: OPENVPN_MTU=1350 + OPENVPN_MSSFIX=1350 so encrypted packets (~1402) fit under
1450. Keeps OpenVPN + VXLAN unchanged. Re-enable vpn-egress. Full layered trace
(pod/node/host) in DECISIONS-LOG.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

platform/vpn-egress/gluetun-gateway.yaml

@@ -41,12 +41,17 @@ spec:
             - name: VPN_TYPE
               value: "openvpn"               # OpenVPN-UDP — satisfies "protocol != TCP" (R-NET); ADR-0013 amended
             - name: OPENVPN_ENDPOINT_PORT
-              value: "8080"                  # NOT 1197 (home NATs its own OpenVPN server there → replies never
-                                             # return) and NOT 53 (this network transparently intercepts :53 DNS,
-                                             # swallowing OpenVPN-over-53). 8080 verified: arbitrary UDP works here
-                                             # (NTP/123 test). Hardcoded string (not ${var}): Flux/kustomize strips
-                                             # quotes on "${VAR}" → int coercion k8s rejects (Longhorn-fix gotcha).
-                                             # Valid PIA ports: 53, 1194, 1197, 1198, 8080, 9201. See DECISIONS-LOG.
+              value: "8080"                  # 8080: PIA confirmed responding here; avoid 53 (this network
+                                             # intercepts DNS/:53). Port is NOT the root cause — MTU is (below).
+                                             # Hardcoded string (not ${var}): Flux/kustomize strips quotes on
+                                             # "${VAR}" → int coercion k8s rejects (Longhorn-fix gotcha).
+            # --- MTU: Cilium runs VXLAN (routing-mode tunnel), so pods get MTU 1450 (1500 − 50 encap) while
+            #     the node/host/WAN are all 1500. OpenVPN's default 1500-byte packets exceed 1450 and are
+            #     dropped (PMTUD broken). Shrink tun-mtu so packets fit: 1350 + ~52 overhead ≈ 1402 < 1450. ---
+            - name: OPENVPN_MTU
+              value: "1350"                  # tun-mtu; keeps encrypted UDP packets under the 1450 pod MTU
+            - name: OPENVPN_MSSFIX
+              value: "1350"                  # clamp TCP-in-tunnel to match, avoid in-tunnel fragmentation
             # PIA credentials from the SOPS secret (Gluetun's PIA OpenVPN creds env):
             - name: OPENVPN_USER
               valueFrom: