fix: add network policies and scope Vault permissions per service

[Flegma]

Summary

Network Policies — Implements network segmentation for the 5stack namespace:

Policy	Effect
default-deny-ingress	Blocks all ingress traffic by default
allow-ingress-to-services	NGINX ingress → web, api, hasura, minio, typesense
allow-timescaledb-ingress	Only hasura + api → timescaledb:5432
allow-redis-ingress	Only api + connector → redis:6379
allow-hasura-ingress	Only api + web + ingress → hasura:8080
allow-api-ingress	Only ingress + connector → api:5585
allow-connector-ingress	Only api → connector:8585

Vault Policy — Replaced wildcard path "*" with explicit per-service read-only paths:

• Each service secret path (kv/data/api, kv/data/redis, etc.) gets read, list only
• Removed create, update, delete capabilities from external-secrets role
• Matches the exact paths used by migrate_secrets_to_vault in setup-env.sh

Test plan

• kubectl kustomize base builds successfully (7 NetworkPolicies generated)
• All services can communicate as expected after applying policies
• External-secrets operator can still read secrets from Vault
• External-secrets CANNOT write/delete secrets

Note: Network policies require a CNI that supports them (Calico, Cilium, etc.). K3s with default Flannel may need --flannel-backend=none + Calico.

Closes #413

[lukepolo]

looks fine but i need to test before merging

[Flegma]

@lukepolo gentle nudge — this has been waiting on your local test since April 9. Sprint 5 cleanup is stalled on #424, #425, #427, #428 landing. Let me know if anything's blocking the test on your end.

[lukepolo]

these break game node server

[lukepolo]

this MR needs more work~

[Flegma]

@lukepolo scoped this down in aeef066 — dropped default-deny-ingress and the allow-ingress umbrella policy.

What's left:

• Per-service ingress restrictions for TimescaleDB, Redis, Hasura, API, MinIO, Typesense, connector (each only accepts traffic from the pods that need it)
• Vault setup script scoped per service
• postgres-backup pod label for the backup CronJob

What this means for game traffic: without default-deny, only pods selected by an allow rule become restricted. Game-server pods aren't selected by any policy here, so CS2 client connections, connector → game-server RCON, and any other game-server traffic flow remain wide-open exactly as before. Should unblock the game node server you saw breaking.

If full mesh policies (covering game-server, web, etc.) are something you want later, happy to file a separate issue once we've sorted out what game-server pod ingress actually needs to look like.