Is your feature request related to a problem?

The Helm chart deploys workloads without network segmentation or disruption budgets. Any pod can talk to any other pod, and rolling updates can take down all replicas simultaneously.

Describe the solution you would like

• Add NetworkPolicy resources: API pods only accept ingress from the LB, worker pods only talk to Postgres/ClickHouse/Redis, no lateral movement between unrelated services
• Add PodDisruptionBudget for API (minAvailable: 1) and worker (minAvailable: 1)
• Both gated behind values:

networkPolicy:
  enabled: false  # opt-in, requires CNI support

podDisruptionBudget:
  api:
    enabled: true
    minAvailable: 1
  worker:
    enabled: true
    minAvailable: 1

Describe alternatives you have considered

Users write their own NetworkPolicies post-install. PDBs left out means cluster upgrades risk downtime.