approval-service: fix NetworkPolicy ingress to allow Traefik from kube-system (DEV-619)

The Phase-1 NetworkPolicy from DEV-614 allowed ingress only from the
`pangolin` namespace, under the mistaken assumption that Traefik runs
there. In this cluster Traefik lives in `kube-system`; Pangolin only
renders the Traefik dynamic config and does not sit in the request
path. The policy therefore blocked external calls to
`approval.proofedmesh.basicstack.de`, which 502'd at Traefik.

Point the ingress rule at `kube-system/app.kubernetes.io/name=traefik`
and update the inline comment to match reality.

Verified: `curl -sS https://approval.proofedmesh.basicstack.de/healthz`
→ `{"status":"ok"}` (HTTP 200, LetsEncrypt cert via Traefik ACME).

Co-Authored-By: Paperclip <noreply@paperclip.ing>

deploy/approval-service/40-networkpolicy.yaml

@@ -27,13 +27,18 @@ spec:
     - Ingress
     - Egress
   ingress:
-    # Public traffic reaches approval-service only via the Pangolin edge
-    # (Traefik lives inside the Pangolin namespace). Keep this list
-    # conservative — add additional callers on demand, not speculatively.
+    # Public traffic reaches approval-service via the Pangolin resource,
+    # but the actual TCP connection is made by the Traefik ingress pod
+    # in kube-system (Pangolin only renders the Traefik config; it does
+    # not sit in the request path). Keep this list conservative — add
+    # additional callers on demand, not speculatively.
     - from:
         - namespaceSelector:
             matchLabels:
-              kubernetes.io/metadata.name: pangolin
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: traefik
       ports:
         - port: 8080
           protocol: TCP