feat(chart): add security, scheduling, and network policy support

[bl4ko]

Summary

Adds configurable Kubernetes best-practice fields to the Helm chart:

Security:

• podSecurityContext — pod-level security context (default: fsGroup: 1000)
• securityContext — container-level security context (default: {})
• Standard app.kubernetes.io/* labels on all resources via _helpers.tpl

Scheduling:

• priorityClassName
• nodeSelector
• tolerations
• affinity

Networking:

• networkPolicy.enabled — optional NetworkPolicy (disabled by default, allows port 3000 when enabled)
• Configurable ingress and egress rules

Motivation

Clusters with policy engines (Kyverno, OPA/Gatekeeper) or PodSecurity Standards enforcement flag the chart for:

1. Missing container securityContext
2. Missing app.kubernetes.io/name label
3. No priorityClassName support
4. No NetworkPolicy

Additionally, nodeSelector, tolerations, and affinity are standard Helm chart fields that users expect for scheduling control.

Container image compatibility note

The default entrypoint runs chown as root before dropping to user node (UID 1000) via su-exec. Setting runAsNonRoot: true will prevent the container from starting unless the entrypoint is changed.

Compatible subset for policy compliance:

securityContext:
  allowPrivilegeEscalation: false
  capabilities:
    drop: ["ALL"]
  seccompProfile:
    type: RuntimeDefault

Test plan

• helm lint passes
• Default helm template output — only new labels added, no behavioral change
• Security context overrides render correctly
• NetworkPolicy renders with default and custom ingress rules
• nodeSelector, tolerations, affinity render correctly
• priorityClassName renders when set, omitted when empty
• Verified Dockerfile entrypoint — documented runAsNonRoot incompatibility

[github-actions]

Wrong target branch

This PR targets main, but contributions must go through dev first.

To fix this, click Edit next to the PR title and change the base branch to dev.

This PR will be automatically closed in 24 hours if the base branch has not been updated.

If you need to merge directly to main, contact a maintainer.