docs: repoint seven stale line-number citations (REN-119)

PR #997 inserted 9 comment lines into `paperless-ns.yaml` and 21 into
`navidrome/deployment.yaml`. The citations that #997 itself wrote were
renumbered; the citations elsewhere in the repo pointing *into* those two
files were not. REN-116 (merged as a8c48b54) then added one more line to
`paperless-ns.yaml`, shifting everything below it by one again.

Seven pointers repointed, all verified against this commit's tree:

  probes-blackbox.yaml:156  navidrome/deployment.yaml   61-74 -> 80-93
  probes-blackbox.yaml:218  paperless-ns.yaml           24-26 -> 34-36
  probes-blackbox.yaml:221  paperless/network-policy    8-12  -> 22-26
  gatus/configmap.yaml:47   paperless-ns.yaml           24-26 -> 34-36
  paperless/network-policy.yaml:15  paperless-ns.yaml   30-32 -> 31-33
  paperless/network-policy.yaml:16  paperless-ns.yaml   33-35 -> 34-36
  paperless/network-policy.yaml:17  paperless-ns.yaml   36-38 -> 37-39

REN-119 specified 34-36 as `33-35` and listed only the first four rows.
Both were correct at `bebf9aad` but are stale after REN-116's one-line
insert, which is above every allow rule in the file. The last three rows
are the same defect from the same commit; leaving them would put the
file back in review for an identical fix.

`paperless-ns.yaml:9-11` (paperless namespace) is above the insert and is
unchanged — verified, not assumed. `navidrome/lidarr.yaml:114-127`,
`lidarr.yaml:29` and `probes-blackbox.yaml:250` were re-checked and are
still correct.

Comments only, and nothing is applied to the cluster. Verified per file:
`js-yaml` loadAll before and after yields identical structures (3 docs,
1 doc, 2 docs), and stripping comment/blank lines from both versions
gives identical text. `gatus/configmap.yaml:47` is in the header above
`data:` (line 62), outside the `config.yaml: |` block scalar, so
ConfigMap `data["config.yaml"]` stays byte-identical at 6572 bytes and
`configmap.reloader.stakater.com/reload: gatus-config` does not roll the
gatus Deployment. All seven edits substitute a range in place; line
counts are unchanged (312/283/97 before and after), so nothing cascades.

Revert: `git revert <this commit>`. Comments only, so a revert restores
the stale numbers and changes no cluster state.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

kubernetes/apps/gatus/configmap.yaml

@@ -44,7 +44,7 @@ metadata:
 # production restart for a comment. This header is outside `data:`, so it is
 # inert; the served config is byte-identical.
 #
-#   * infrastructure/network-policies/paperless-ns.yaml:24-26 ALREADY admits
+#   * infrastructure/network-policies/paperless-ns.yaml:34-36 ALREADY admits
 #     the whole monitoring namespace on every port, and monitoring is where
 #     blackbox-exporter runs. Cilium unions the allow rules of every CNP
 #     selecting an endpoint, so no extra policy is required.

kubernetes/apps/monitoring-rules/probes-blackbox.yaml

@@ -153,7 +153,7 @@ spec:
         # `flux reconcile kustomization monitoring-rules --with-source`.
         #
         # /ping on both: unauthenticated, and already the pods' own kubelet
-        # probe path (navidrome/deployment.yaml:61-74,
+        # probe path (navidrome/deployment.yaml:80-93,
         # navidrome/lidarr.yaml:114-127). For lidarr that it is ungated is
         # proven independently of the gate — lidarr.yaml:29 curls /ping in a
         # loop BEFORE it has read the API key out of config.xml.
@@ -215,10 +215,10 @@ spec:
         #
         # That gatus comment says the in-cluster probe "needs a
         # CiliumNetworkPolicy first". That sentence is simply WRONG, not
-        # merely inapplicable: paperless-ns.yaml:24-26 already admits the
+        # merely inapplicable: paperless-ns.yaml:34-36 already admits the
         # whole monitoring namespace, which is where blackbox-exporter runs,
         # and Cilium unions the allow rules of every CNP selecting an
-        # endpoint (the mechanism apps/paperless/network-policy.yaml:8-12
+        # endpoint (the mechanism apps/paperless/network-policy.yaml:22-26
         # relies on). The EGRESS paragraph in the block above applies here
         # identically. Nothing in the paperless namespace is edited by this
         # change.

kubernetes/apps/paperless/network-policy.yaml

@@ -12,9 +12,9 @@
 # described below). The effective ingress set is this outpost PLUS, on
 # every port:
 #   - the paperless namespace   (paperless-ns.yaml:9-11)
-#   - the database namespace    (paperless-ns.yaml:30-32)
-#   - the monitoring namespace  (paperless-ns.yaml:33-35)
-#   - host / remote-node        (paperless-ns.yaml:36-38)
+#   - the database namespace    (paperless-ns.yaml:31-33)
+#   - the monitoring namespace  (paperless-ns.yaml:34-36)
+#   - host / remote-node        (paperless-ns.yaml:37-39)
 # So any pod in database or monitoring can reach this HTTP listener
 # directly and set X-Authentik-Username to any value. Do not read this
 # rule as the whole boundary. Narrowing is tracked in REN-28.