feat: Traefik support, optional Let's Encrypt, configurable port bind, hostname-numbered slots, dblink in extensions schema

- Traefik is a first-class ingress controller choice: per-instance Middleware
  caps uploads at 50 MiB, nginx keeps its proxy-* annotations; picked in setup
- Let's Encrypt is optional: off skips the ClusterIssuer and gives each instance
  a 10-year self-signed certificate instead of a Let's Encrypt one
- New port_bind setting: lan (default, LAN IP only), all (LAN + localhost),
  local (localhost only)
- Hostname slots are keyed by the digit in the name (supa4 -> slot 4), so the
  instance number, ports and hostname stay in step on every machine
- The log-retention job installs dblink and its helper into the extensions
  schema instead of public: in public they break the app's
  REVOKE ALL ON ALL ROUTINES IN SCHEMA public for the non-superuser postgres
  role (42501 permission denied for function dblink_connect_u)

templates/values.yaml.tpl

@@ -71,13 +71,9 @@ environment:
 ingress:
   enabled: true
   className: ${INGRESS_CLASS}
-  annotations:
-    # The chart default rewrites every path to "/", which breaks all APIs; null removes it.
-    nginx.ingress.kubernetes.io/rewrite-target: null
-    nginx.ingress.kubernetes.io/proxy-body-size: 50m
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
-    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
-    cert-manager.io/cluster-issuer: ${CLUSTER_ISSUER}
+  # The annotation map is built in code (ingress_annotations): nginx gets proxy-* and a
+  # nulled rewrite-target, Traefik gets its Middleware reference, cert-manager its issuer.
+  annotations: ${INGRESS_ANNOTATIONS}
   tls:
     - hosts: [${HOST}]
       secretName: ${TLS_SECRET}