Helm chart follow-ups: ingress for TLS termination, PVC, RBAC, OpenShift guidance

[coopernetes]

Summary

The Helm chart ships Deployment, Service, ConfigMap and probes only. The chart README lists the rest as follow-up work with no tracking issue; this issue is that tracker. The first item is TLS terminated at the ingress with plaintext inside the cluster, which today has to be assembled by hand alongside the chart.

Wanted

• An ingress template, off by default, with host, TLS secret, ingress class and annotations as values. Enabling it sets server.service-url to the external host and turns on the dashboard's forwarded-header setting from Reverse-proxy deployment: explicit forwarded-header setting for the dashboard and TLS-shape docs #587, so login redirects and cookie security reflect the external address.
• Chart documentation for the two supported shapes, matching the admin guide.
• The remaining README follow-ups, each as a value-gated template: a PersistentVolumeClaim for single-replica file databases, ServiceAccount and RBAC, and OpenShift SecurityContextConstraints guidance. A Kustomize base is a separate decision.
• The chart README points at this issue instead of describing the gaps in prose.

Boundaries

• One ingress covering the dashboard and the git listeners; per-listener ingresses are not in scope.
• No service-mesh or gateway-API variant.
• The template does not need to wait for Reverse-proxy deployment: explicit forwarded-header setting for the dashboard and TLS-shape docs #587: server.service-url exists today, and the forwarded-header value is added when that key lands.