fix: Cilium lbExternalClusterIP for pod→LB hairpin

With L2 announcements, the LoadBalancer VIP is advertised via ARP on
the LAN, so traffic from a pod to its own cluster's LB VIP times out.
Enable bpf.lbExternalClusterIP so Cilium redirects the socket straight
to the backend pod, fixing server-to-server OIDC from paperless to
auth.k.renner.uno.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

kubernetes/infrastructure/cilium/helmrelease.yaml

@@ -34,6 +34,11 @@ spec:
     ipam:
       mode: kubernetes
     kubeProxyReplacement: true
+    bpf:
+      # Let pods reach the cluster's own LoadBalancer external IPs; Cilium
+      # redirects the socket directly to the backend pod instead of sending
+      # traffic out to the VIP and back (which fails with L2 announcements).
+      lbExternalClusterIP: true
     # Talos-specific settings
     securityContext:
       capabilities: