Switch workers to custom WireGuard provider with correct endpoint IPs

gluetun's bundled protonvpn server list has stale IPs for US-TX#179
(37.19.200.26) and US-TX#220 (95.173.217.2). The WIREGUARD_ENDPOINT_IP
env var is a filter not an override, so there's no way to redirect
protonvpn provider to a new IP.

Switch to custom WireGuard provider with hardcoded endpoint IPs from
fresh ProtonVPN configs (95.173.217.29 / 146.70.58.130). Add
DNS_KEEP_NAMESERVER=on so gluetun leaves k8s DNS intact instead of
routing DNS through its own proxy (which breaks in-cluster).

Port forwarding is not available with custom provider; will restore
once gluetun releases an updated server list image.

servers/legion/k8s/media/fornax-workers.yaml

@@ -92,7 +92,7 @@ spec:
               add: ["NET_ADMIN"]
           env:
             - name: VPN_SERVICE_PROVIDER
-              value: "protonvpn"
+              value: "custom"
             - name: VPN_TYPE
               value: "wireguard"
             - name: WIREGUARD_PRIVATE_KEY
@@ -100,14 +100,18 @@ spec:
                 secretKeyRef:
                   name: fornax-worker-tx253-secrets
                   key: PROTONVPN_PRIVATE_KEY
-            - name: SERVER_NAMES
-              value: "US-TX#179"
-            - name: VPN_PORT_FORWARDING
+            - name: WIREGUARD_PUBLIC_KEY
+              value: "mngiSxBpH7GU24nnWdBEcnhDnCPn2jq5+ZP3zwPwISA="
+            - name: WIREGUARD_ADDRESSES
+              value: "10.2.0.2/32"
+            - name: VPN_ENDPOINT_IP
+              value: "95.173.217.29"
+            - name: VPN_ENDPOINT_PORT
+              value: "51820"
+            - name: DNS_KEEP_NAMESERVER
               value: "on"
             - name: FIREWALL_OUTBOUND_SUBNETS
               value: "10.42.0.0/16,10.43.0.0/16"
-            - name: WIREGUARD_ENDPOINT_IP
-              value: "95.173.217.29"
           volumeMounts:
             - name: gluetun-data
               mountPath: /tmp/gluetun
@@ -300,7 +304,7 @@ spec:
               add: ["NET_ADMIN"]
           env:
             - name: VPN_SERVICE_PROVIDER
-              value: "protonvpn"
+              value: "custom"
             - name: VPN_TYPE
               value: "wireguard"
             - name: WIREGUARD_PRIVATE_KEY
@@ -308,14 +312,18 @@ spec:
                 secretKeyRef:
                   name: fornax-worker-tx34-secrets
                   key: PROTONVPN_PRIVATE_KEY
-            - name: SERVER_NAMES
-              value: "US-TX#220"
-            - name: VPN_PORT_FORWARDING
+            - name: WIREGUARD_PUBLIC_KEY
+              value: "wqJcz4akzVFxx35aJ5B7G/IJ9qsRvpcGNub3rLHcqXo="
+            - name: WIREGUARD_ADDRESSES
+              value: "10.2.0.2/32"
+            - name: VPN_ENDPOINT_IP
+              value: "146.70.58.130"
+            - name: VPN_ENDPOINT_PORT
+              value: "51820"
+            - name: DNS_KEEP_NAMESERVER
               value: "on"
             - name: FIREWALL_OUTBOUND_SUBNETS
               value: "10.42.0.0/16,10.43.0.0/16"
-            - name: WIREGUARD_ENDPOINT_IP
-              value: "146.70.58.130"
           volumeMounts:
             - name: gluetun-data
               mountPath: /tmp/gluetun