fix: Correct authentik-server NetworkPolicy ports (container port, not Service port)

Caused a live 502 immediately after deploy: the rule allowed 80/443
(the Service's external ports), but NetworkPolicy filters on the pod's
actual container port after kube-proxy's DNAT - authentik-server's
Service maps 80->9000 and 443->9443. Confirmed root cause by suspending
Flux reconciliation (it was silently re-applying my manual test
deletions) and testing with the policies truly absent.

apps/authentik/networkpolicy.yaml

@@ -38,10 +38,12 @@ spec:
             matchLabels:
               kubernetes.io/metadata.name: matrix
       ports:
+        # NetworkPolicy matches the pod's actual container port, not the Service's
+        # external port - the authentik-server Service maps 80->9000, 443->9443.
         - protocol: TCP
-          port: 80
+          port: 9000
         - protocol: TCP
-          port: 443
+          port: 9443
 ---
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy