Helm chart: naming, labels, security context, lint #82

Why?

Apart from configuration (#67) and MongoDB (#68), the Helm chart in deployment/ does not follow common chart conventions, which makes it hard to install twice in one namespace, to review, and to run on hardened clusters:

• Resource names are hard-coded (mongodb for the Deployment, Service and PVC; mongo-init-script; app-config) or taken from cloud_registry.appName, instead of being derived from the release name, so two releases in one namespace collide.
• No standard labels (app.kubernetes.io/name, instance, version, managed-by, helm.sh/chart); selectors use a plain app label.
• securityContext: {}: no runAsNonRoot, dropped capabilities or read-only root filesystem.
• The Ingress has no ingressClassName and no way to add annotations other than the cert-manager ones.
• NOTES.txt always prints https:// URLs, even with ingress.https.enabled: false, and prints https:///... if host_name is empty; the example curl sends a token, which reads no longer need after Cloud Registry backend: public read access, service ownership, ECP_CLN:ADMIN admin role #62.
• If ingress.enabled is false on a cluster without the OpenShift Route API, cloud-registry-route.yaml renders nothing, so the app is silently not exposed.
• No values.schema.json, and the chart is not linted or rendered in CI. Chart.yaml has the default description "A Helm chart for Kubernetes".

How?

1. Add _helpers.tpl with fullname, labels and selectorLabels helpers; derive all names from them; reference the MongoDB service name in the app config through the helper (with Helm chart: configure app via values and FOCA overlays #67).
2. Add a configurable securityContext/podSecurityContext with safe defaults that also work on OpenShift.
3. Ingress: className and free-form annotations in values.
4. NOTES: use the right scheme, warn if host_name is empty, and warn if neither an Ingress nor a Route is rendered.
5. Add values.schema.json; run helm lint and helm template in CI.
6. Alternatively, implement this in the shared FOCA library chart proposed in Shared Helm library chart for FOCA apps foca#312 and make this chart a thin wrapper.

Changing names and selectors changes immutable fields, so existing releases need a documented migration (reinstall, keeping the MongoDB PVC).

Acceptance criteria

• Two releases can be installed in the same namespace.
• helm lint and helm template with test values pass in CI.
• Pods run as non-root with dropped capabilities.
• NOTES are correct for HTTP, HTTPS, empty host and no-ingress cases.

Dependencies: #67 and #68; possibly superseded by elixir-cloud-aai/foca#312.