Ship NetworkPolicy templates for production hardening

[fbeneventi]

Context

Production hardening documentation has historically promised
NetworkPolicy-based isolation as a feature of the staging and
production profiles. No NetworkPolicy resources exist in any subchart
or in the umbrella chart's templates/.

Impact

Pod-to-pod traffic is unrestricted; any compromised pod can reach
Cassandra, KairosDB, the MQTT broker, and the API directly. False
claims about NetworkPolicies have been stripped from the v0.5.0 docs
pending real templates.

Desired behaviour

Ship NetworkPolicy templates that implement the following isolation
matrix (subject to revision):

• KairosDB: ingress only from mqtt2kairosdb, examon-server, Grafana,
  Trino (if installed); egress to Cassandra.
• Cassandra: ingress only from KairosDB and other Cassandra pods
  (gossip / intra-cluster); no public ingress.
• Mosquitto: ingress from external LoadBalancer + mqtt2kairosdb;
  egress none required internally.
• examon-server: ingress from Ingress controller + Trino; egress to
  Cassandra and KairosDB.
• Grafana: ingress from Ingress controller; egress to KairosDB and
  examon-server.

Templates should be opt-in (global.networkPolicies.enabled) and
support the values-staging.yaml / values-production.yaml overlays.

Current workaround (documented)

docs/administrators/deploy/harden-for-production.md § Known gaps in
v0.5.0 states that operators must apply NetworkPolicies manually until
the chart ships templates.

Files to touch

• deploy/helm/examon/templates/networkpolicies/ (new directory)
• deploy/helm/examon/values.yaml (global.networkPolicies.enabled)
• deploy/helm/examon/values-staging.yaml
• deploy/helm/examon/values-production.yaml
• Subchart values where applicable

Doc cleanup when closed

• Remove the NetworkPolicies paragraph from
  docs/administrators/deploy/harden-for-production.md § Known gaps.
• Restore the NetworkPolicies row in
  docs/administrators/deploy/index.md environments table.
• Restore NetworkPolicy mentions in docs/administrators/deploy/staging.md
  and docs/get-started/where-next.md.