`PDF_GENERATION_API` is hardcoded to a l3montree cloud endpoint; `INSTANCE_DOMAIN` falls back to the in-cluster URL when the API ingress is disabled

Summary

Two env vars on the API deployment can't be set through values, which matters for self-hosted installs that (a) must not call external services and (b) expose the API through something other than an Ingress (Gateway API HTTPRoute, OpenShift Route, a mesh, …).

Chart version: 1.13.2 (main @ 0f0c3e7).

1. PDF_GENERATION_API hardcoded

https://github.com/l3montree-dev/devguard-helm-chart/blob/0f0c3e7ac27fabc9ba1ffad72aafb41f57161358/templates/devguard/deployment.yaml#L189-L190

- name: PDF_GENERATION_API
  value: https://dwt-api.dev-l3montree.cloud/pdf

Every self-hosted instance sends report data to a l3montree-operated endpoint by default, and there is no value to change or disable it. The application itself treats it as configuration (.env.example has PDF_GENERATION_API=), so the chart should too.

The only workaround today is api.additionalEnvs, which appends a second PDF_GENERATION_API entry after the hardcoded one and relies on Kubernetes keeping the last duplicate it works, but the API server warns about duplicate env names and it's not something operators should have to know.

Proposal:

api:
  pdfGenerationApi: ""   # empty = feature disabled / no external call

2. INSTANCE_DOMAIN when api.ingress.enabled=false

https://github.com/l3montree-dev/devguard-helm-chart/blob/0f0c3e7ac27fabc9ba1ffad72aafb41f57161358/templates/devguard/deployment.yaml#L173-L178

- name: INSTANCE_DOMAIN
  {{- if .Values.api.ingress.enabled }}
  value: {{ printf "%s://%s" $apiProtocol $apiHost }}
  {{- else }}
  value: http://devguard-api-service.{{ .Release.Namespace }}.svc.cluster.local:8080
  {{- end }}

api.ingress.host / api.ingress.tls must still be set even with the ingress disabled (the devguard.apiHost helper fails otherwise), but they are then ignored for INSTANCE_DOMAIN. When the API is published by an HTTPRoute instead of an Ingress, the instance advertises an unreachable in-cluster URL.

Proposal: derive INSTANCE_DOMAIN from api.ingress.host/tls whenever a host is set, regardless of api.ingress.enabled (mirroring how FRONTEND_URL is already derived from web.ingress.host unconditionally), or add an explicit api.publicUrl value.