feat(network-policies): cross-namespace ingress isolation (Cilium + Kyverno)

[Shion1305]

What

Cluster-wide cross-namespace ingress isolation using Cilium + Kyverno. Ingress
is default-denied per namespace (same-namespace allowed); egress is left open, so
internet / DNS / API-server access is unaffected.

How

• network-policies/cross-ns-isolation-generator.yaml — a Kyverno ClusterPolicy
  generates a default-deny-ingress NetworkPolicy into every non-system namespace,
  including ones created later (new apps). generateExisting backfills existing
  namespaces; synchronize keeps them aligned and removes them on rollback. A
  standard networking.k8s.io NetworkPolicy is generated (no extra Kyverno RBAC);
  Cilium merges it additively with the Cilium allows.
• network-policies/allow-from-infra.yaml — universal ingress allows:
  host/remote-node (kubelet probes), kube-apiserver (webhooks), health,
  envoy-gateway-system (ingress proxy), grafana (Prometheus scrape + operator).
• East-west (app-to-app) allows live in each receiving app's directory as a
  CiliumNetworkPolicy:

Receiver	Source	Port	File
shared Postgres	adminer, atc, harbor, keycloak, langfuse, mlflow, nc-press-chotatsu, openwebui, postgres-operator	5432	postgres-shared/networkpolicy.yaml
shared Postgres	postgres-operator (Patroni)	8008	postgres-shared/networkpolicy.yaml
vault	external-secrets	8200	vault/networkpolicy.yaml
atc (app=postgres-mcp)	openwebui	8000	atc/network-policy-openwebui-to-mcp.yaml
grafana (Prometheus)	monitoring (cloudflare-grafana datasource)	9090	grafana/networkpolicy.yaml
monitoring (app=cloudflare-grafana)	world (external)	3000	cloudflare-exporter/networkpolicy.yaml

Excludes kube-system / kube-node-lease / kube-public / kyverno.

Derivation & validation

Allow set derived from a Hubble flow capture across all nodes, cross-checked against
repo manifests, live Services and existing per-app NetworkPolicies (the
grafana←monitoring:9090 datasource edge was found by static analysis — it only fires
on dashboard render). Validated: kustomize build, kubeconform --strict (9/9),
server-side dry-run (Cilium + Kyverno admission), and a live test confirming a new
namespace receives the generated policy in ~1-2s.

⚠️ Rollout

root-app auto-syncs apps/, so merging default-denies ingress across all
non-excluded namespaces at once (generateExisting). To stage, scope the generator
to a pilot namespace, watch hubble observe --verdict DROPPED, then widen.
Rollback: delete the cross-ns-isolation ClusterPolicy — synchronize removes
every generated policy and namespaces revert to default-allow. See
network-policies/README.md.

Supersedes #139.