controller mode: pangolin server NetworkPolicy blocks the Gerbil HTTP API (peers can never be added)

**Chart:** pangolin 0.1.0-alpha.1 (also reproduced against `charts/pangolin/templates/networkpolicy.yaml` on `main` as of 2026-09-11). **Server:** Pangolin 1.18.3. **Cluster:** k3s (network policy controller enabled).

**Property the chart needs:** the `-pangolin-egress` NetworkPolicy must allow the pangolin server to reach Gerbil's HTTP API (`gerbil.ports.internalApi`, default 3004 TCP). Today the server egress list is DNS, the database, and `0.0.0.0/0:443`. The server calls `http://-gerbil:3004/peer` for every site/client registration, so with the chart defaults no tunnel can ever come up.

**What we saw:** after creating a Newt site, the pangolin log shows

```
Adding peer with public key … to exit node 1
Error making POST request (can Pangolin see Gerbil HTTP API?) for exit node at http://pangolin-pangolin-gerbil:3004 (status: undefined): connect ECONNREFUSED 10.43.122.113:3004
Failed to add peer to exit node: Error: connect ECONNREFUSED 10.43.122.113:3004
```

Newt reports `SendMessageInterval timed out … newt/wg/get-config`. The gerbil ingress policy already admits the server on 3004; only the server's egress side is missing. Adding one egress rule (podSelector = gerbil component, TCP `gerbil.ports.internalApi`) fixed it immediately; we run that as a supplementary NetworkPolicy.

The `main` template now has `networkPolicy.pangolin.extraEgress`, which lets users add the rule themselves, but the default rendering still cannot register peers, so this looks like a defaults bug rather than a configuration choice.

Happy to test a fix against our cluster (k3s, controller mode, CNPG database) — say which branch or prerelease chart.