[G-09] StorageClass lifecycle, encryption, and provider enum

## Summary
The AWS gp3 StorageClass renders as a `pre-install,pre-upgrade` hook with no `hook-delete-policy` (`templates/config/sc/aws-gp3.yaml:8-10`). Helm's default hook policy is `before-hook-creation`, so every upgrade deletes and recreates the StorageClass. Encryption is commented out, and the values schema accepts four `provider` values that do nothing.

### Details
**1. Hook lifecycle.** Verified on a live cluster: after `helm upgrade` the StorageClass has a new UID, and annotations added by hand (for example `is-default-class`) are wiped. `helm uninstall` leaves the object behind, since hook resources are not part of the release. If a later upgrade stops rendering the hook, the old StorageClass is orphaned. One correction to the audit text: adding `"helm.sh/hook-delete-policy": before-hook-creation` explicitly changes nothing, because it is already the default. It would only document the behavior.

**2. Encryption.** `# encrypted: "true"` is commented out at line 15, so volumes are unencrypted unless the AWS account enforces encryption by default.

**3. Dead enum values.** `values.schema.json:13` allows `aws`, `aws-managed-sc`, `azure`, `gcp`, and `microk8s`, but only `aws` renders anything (`aws-gp3.yaml:1`, name map at `_helpers.tpl:418-423`). `provider: gcp` renders no StorageClass and no `storageClassName`, silently falling back to the cluster default class. `aws-managed-sc` was implemented in `d021812` and removed in `840fe1a`. The others never existed.

Repro: install with `provider=aws`, annotate the StorageClass, upgrade with identical values. The UID changes and the annotation is gone. (`--set mongodb.communityResource.enabled=false --set graylog.config.mongodb.customUri=mongodb://user:pass@mongo:27017/graylog` lets the chart install without the MongoDB operator.)

**Reference:** G-09 (Production Readiness Review)

### Impact
Manual changes to the StorageClass are silently reverted on every upgrade. An upgrade failing between delete and recreate leaves new PVCs `Pending`. Uninstall orphans the object. New volumes may be unencrypted. Four provider values read as support that does not exist.

## Notes for maintainers
1. **Lifecycle decision.** Either keep the hook and add the (behavior-neutral) explicit delete-policy annotation plus a template comment stating the lifecycle, or drop the hook and manage the StorageClass as a normal release resource. The catch with the latter: `provisioner`, `parameters`, `reclaimPolicy`, and `volumeBindingMode` are immutable, so future changes to them would fail the upgrade instead of replacing the object.
2. **Encryption.** Uncomment `encrypted: "true"`. EBS encryption is fixed at volume creation, so this only affects volumes provisioned afterward. Decide whether to default it for everyone or expose it as a value so existing installs keep current behavior.
3. **Trim the enum** to `["aws", ""]` and re-add values when implementations land. The `{"type": "null"}` branch next to it is dead code, since the outer `"type": "string"` already rejects null.

Start with templates/config/sc/aws-gp3.yaml:8-15, _helpers.tpl:418-423, and values.schema.json:13; reproduce the install, annotation, and upgrade behavior described in the issue. Review the lifecycle alternatives and encryption default decision, then verify that provider values match implemented rendering and that the StorageClass behavior, schema, and documentation are consistent.

Written by the indexing model from the issue text.