Switch workers to custom WireGuard provider with correct endpoint IPs

gluetun's bundled protonvpn server list has stale IPs for US-TX#179
(37.19.200.26) and US-TX#220 (95.173.217.2). The WIREGUARD_ENDPOINT_IP
env var is a filter not an override, so there's no way to redirect
protonvpn provider to a new IP.

Switch to custom WireGuard provider with hardcoded endpoint IPs from
fresh ProtonVPN configs (95.173.217.29 / 146.70.58.130). Add
DNS_KEEP_NAMESERVER=on so gluetun leaves k8s DNS intact instead of
routing DNS through its own proxy (which breaks in-cluster).

Port forwarding is not available with custom provider; will restore
once gluetun releases an updated server list image.

servers/legion/k8s/fornax/worker/base/deployment.yaml

@@ -63,7 +63,7 @@ spec:
                 - NET_ADMIN
           env:
             - name: VPN_SERVICE_PROVIDER
-              value: protonvpn
+              value: custom
             - name: VPN_TYPE
               value: wireguard
             - name: WIREGUARD_PRIVATE_KEY
@@ -71,9 +71,15 @@ spec:
                 secretKeyRef:
                   name: fornax-worker-WORKER_ID-secrets
                   key: PROTONVPN_PRIVATE_KEY
-            - name: SERVER_NAMES
-              value: PLACEHOLDER_SERVER_NAME
-            - name: VPN_PORT_FORWARDING
+            - name: WIREGUARD_PUBLIC_KEY
+              value: PLACEHOLDER_PUBLIC_KEY
+            - name: WIREGUARD_ADDRESSES
+              value: 10.2.0.2/32
+            - name: VPN_ENDPOINT_IP
+              value: PLACEHOLDER_ENDPOINT_IP
+            - name: VPN_ENDPOINT_PORT
+              value: "51820"
+            - name: DNS_KEEP_NAMESERVER
               value: "on"
             - name: FIREWALL_OUTBOUND_SUBNETS
               value: 10.42.0.0/16,10.43.0.0/16