improve(helm): production hardening for the OpenViking chart

[jangrui]

Production hardening for the OpenViking Helm chart (deploy/helm/openviking/)

Correctness

• Added a fail-fast check for root_api_key. Since the server requires a root API key for any non-loopback bind, installation now fails whenever server.host is set to a non-loopback address and root_api_key is not configured.
• Changed the default image.tag from the mutable latest to Chart.appVersion (v0.4.9), and updated image.pullPolicy to IfNotPresent.
• Added the missing ServiceAccount template.
• Fixed the app.kubernetes.io/version label to use the actual application version instead of always reporting latest.
• Added helm.sh/resource-policy: keep to the PVC so persistent data is retained after helm uninstall.

Multi-instance support (disabled by default)

• Added optional support for HPA, PodDisruptionBudget, and configurable Deployment update strategies.
• Added validation to prevent unsupported multi-instance configurations. Scaling beyond one replica now requires both:
  • skip_process_lock: true
  • shared storage (either a remote backend or a ReadWriteMany PVC)
• When HPA is enabled, the chart omits the replicas field so replica management is left entirely to the HPA controller.
• Documented the setup in a new Multi-Instance Deployment section in the README.

Optional resources

• Added an optional ServiceMonitor with configurable labels, relabelings, and metric relabelings.
• Added an optional NetworkPolicy for restricting ingress traffic.

Service improvements

• Added support for common Service settings, including:
  • annotations
  • loadBalancerIP
  • externalTrafficPolicy
  • loadBalancerSourceRanges

Observability

• Added a disabled-by-default config.server.observability section for configuring OpenTelemetry metrics, traces, and logs.

Validation

• helm lint passes.
• Verified chart rendering across 13 deployment scenarios, including all multi-instance validation paths.