fix(security): CiliumNetworkPolicy allowing cluster/host/remote-node ingress

Fixes pod-network drops when hostNetwork ingress DaemonSet (hanzo-ingress
in lux-system) sends cross-node traffic to pod-CIDR backends in hanzo ns.

Cilium resolves source identity as remote-node for hostNetwork traffic,
which doesn't match pod-label selectors in standard NetworkPolicies.
fromEntities: [cluster, host, remote-node] covers all in-cluster sources.

Unblocks: lux.finance, lux.industries, blog.lux.network, blog.lux.network/api/search,
vote.lux.network (all were 504-ing at CF edge due to policy drops).

k8s/security/cilium-allow-cluster-ingress.yaml

@@ -0,0 +1,17 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-cluster-ingress
+  namespace: hanzo
+  labels:
+    app.kubernetes.io/component: network-policy
+    app.kubernetes.io/managed-by: lux-universe
+    app.kubernetes.io/part-of: lux-universe
+spec:
+  endpointSelector:
+    matchLabels: {}
+  ingress:
+  - fromEntities:
+    - cluster
+    - host
+    - remote-node