Switch VPN provider ExpressVPN -> PIA (ADR-0013 supersedes ADR-0012)

Operator turned off ExpressVPN auto-renew and purchased PIA. The single-shared-
gateway model is retained; provider/client/protocol change to PIA via Gluetun
over WireGuard with native port forwarding (qbittorrent-natmap port-sync).
Simpler than ExpressVPN: no custom OpenVPN config, just PIA user/pass
SOPS-encrypted; Gluetun provides the built-in kill-switch.

Updated: ADR-0013 (new) + ADR-0012 superseded + index; docs 00,01,03,07;
task board (T-3.2p/T-3.2, OQ-3).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

docs/00-vision-and-scope.md

@@ -82,7 +82,7 @@ mandatory; `SHOULD` is strongly preferred and requires an ADR to deviate.
 - **R-NET-05** — A service MUST be able to declare its **egress class**: `internet` (standard local
   network/internet) or `vpn` (routed through a custom VPN connection). VPN routing MUST be enforced
   **outside the service** (a single shared in-cluster gateway), so a service cannot leak by
-  misconfiguration (ADR-0012, OQ-3).
+  misconfiguration (ADR-0013, OQ-3).
 - **R-NET-06** — VPN-class egress MUST enforce a **kill-switch**: if the VPN tunnel is down, the
   service MUST NOT leak traffic to the standard internet.
 - **R-NET-07** — Egress class MUST be a declarative property of the service, changeable via GitOps
@@ -191,9 +191,10 @@ implementation.
   cluster**; the specific backing is **TBD later** and does not block the core platform. Plex's
   metadata DB still lives on replicated Longhorn. The **off-cluster DR backup target** (for app
   config, Nextcloud, Gitea, etc.) remains to be chosen at Phase 4. See [`04`](04-storage-and-state.md).
-- **OQ-3 (VPN)** — **RESOLVED**: **ExpressVPN**, cluster-provisioned, **single shared in-cluster
-  tunnel**, **non-TCP** (OpenVPN UDP / Lightway-UDP), rules enforced outside the service
-  (ADR-0012). See [`03`](03-networking-isolation-and-egress.md).
+- **OQ-3 (VPN)** — **RESOLVED**: **PIA** via Gluetun, cluster-provisioned, **single shared
+  in-cluster tunnel** over **WireGuard** (non-TCP), native port forwarding, rules enforced outside
+  the service (ADR-0013, supersedes ADR-0012's ExpressVPN choice). See
+  [`03`](03-networking-isolation-and-egress.md).
 
 - **OQ-4 (TLS/DNS challenge access)** — **RESOLVED**: a **scoped Cloudflare API token**
   (`Zone·DNS·Edit`, `keithjackson.dev`), SOPS-encrypted, drives cert-manager DNS-01 and ExternalDNS.