feat(examples): add deployment examples for common use cases

Add 5 example configurations covering popular deployment scenarios:

1. minimal.yaml - Quick start with ephemeral storage
2. production.yaml - Production setup with PVC and resource limits
3. hardware-acceleration.yaml - GPU transcoding (Intel QuickSync)
4. ingress-tls.yaml - External access with HTTPS and cert-manager
5. network-policy.yaml - Secure deployment with network isolation

Includes comprehensive README explaining usage and combinations.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>

charts/jellyfin/examples/network-policy.yaml

@@ -0,0 +1,74 @@
+# Secure Jellyfin deployment with NetworkPolicy
+# Network isolation with controlled ingress/egress
+#
+# Prerequisites:
+# - CNI plugin with NetworkPolicy support (Calico, Cilium, etc.)
+# - Ingress controller running in ingress-nginx namespace
+#
+# Usage:
+#   helm install jellyfin jellyfin/jellyfin -f network-policy.yaml
+
+# NetworkPolicy configuration
+networkPolicy:
+  enabled: true
+
+  # Ingress: Allow only from Ingress controller
+  ingress:
+    allowExternal: false
+    namespaceSelector:
+      matchLabels:
+        name: ingress-nginx
+    podSelector:
+      matchLabels:
+        app.kubernetes.io/name: ingress-nginx
+
+  # Egress: Restricted for security
+  egress:
+    allowDNS: true  # Required for DNS resolution
+    allowAllEgress: false  # Block unrestricted internet
+    restrictedEgress:
+      allowMetadata: true  # Allow HTTPS/443 for TMDB, TheTVDB, etc.
+      allowInCluster: false  # Block pod-to-pod communication
+
+# Ingress for external access
+ingress:
+  enabled: true
+  className: nginx
+  hosts:
+    - host: jellyfin.example.com
+      paths:
+        - path: /
+          pathType: Prefix
+
+# Persistent storage
+persistence:
+  config:
+    enabled: true
+    size: 10Gi
+  media:
+    enabled: true
+    size: 500Gi
+  cache:
+    enabled: true
+    size: 20Gi
+
+# Security context
+securityContext:
+  runAsUser: 1000
+  runAsGroup: 1000
+  fsGroup: 1000
+  runAsNonRoot: true
+  allowPrivilegeEscalation: false
+  readOnlyRootFilesystem: false
+  capabilities:
+    drop:
+      - ALL
+
+# Resource limits
+resources:
+  limits:
+    cpu: 2000m
+    memory: 4Gi
+  requests:
+    cpu: 500m
+    memory: 1Gi