fix: scope network policies to internal services only

Drop default-deny-ingress and allow-ingress policies. Without a
default-deny in place, only pods explicitly selected by allow-internal
become restricted — game-server pods (and any other unselected pod)
remain wide-open, so CS2 client traffic and connector/RCON paths are
not affected.

Per-service ingress restrictions (TimescaleDB, Redis, Hasura, API,
MinIO, Typesense, connector) still apply.

Author: Flegma

base/network-policies/allow-ingress.yaml

@@ -2,6 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - default-deny.yaml
-  - allow-ingress.yaml
   - allow-internal.yaml