feat(s3): add gitea-db NetworkPolicies and Valkey values template

- gitea-db-networkpolicies.yaml: allow-egress-kube-api and
  allow-ingress-from-cnpg-operator for gitea-db cluster pods;
  required because databases namespace has default-deny-all policy
  and existing allow rules only covered net-kingdom-pg
- valkey-values.sops.yaml.template: standalone Valkey Helm values
  template with Gitea connection string documentation
- .gitignore: allow *-networkpolicies.yaml alongside *-cluster.yaml

Fixes gitea-db initdb failure (T03); gitea-db cluster now healthy.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

helm/valkey-values.sops.yaml.template

@@ -0,0 +1,21 @@
+# Valkey standalone Helm values — S3 Platform Services
+# Encrypt before committing: sops -e -i helm/valkey-values.sops.yaml
+# Deploy: make valkey-deploy
+#
+# Gitea connection strings (update gitea-values.sops.yaml after deployment):
+#   cache:    redis://:PASSWORD@valkey-master.platform.svc.cluster.local:6379/0
+#   session:  redis://:PASSWORD@valkey-master.platform.svc.cluster.local:6379/1
+#   queue:    redis://:PASSWORD@valkey-master.platform.svc.cluster.local:6379/2
+auth:
+  enabled: true
+  password: REPLACE_WITH_PASSWORD   # encrypt with SOPS
+
+architecture: standalone   # single node; upgrade to replication when RAM allows
+
+master:
+  persistence:
+    enabled: true
+    size: 2Gi
+
+replica:
+  replicaCount: 0   # standalone mode — no replicas