feat: Add NetworkPolicy for flightdeck component

[ian-flores]

Summary

Add flightdeck to the list of components that get NetworkPolicies created by the site controller.

Previously, flightdeck was the only component without a NetworkPolicy, which caused issues in environments with default-deny network policies.

Changes

• Add DefaultPortFlightdeckHTTP constant (8080)
• Add reconcileFlightdeckNetworkPolicy() function
• Add flightdeck to cleanup function
• Policy allows ingress from traefik/alloy on port 8080, egress to all

Test plan

• Deploy to test cluster
• Verify NetworkPolicy is created for flightdeck
• Verify flightdeck UI accessible through traefik

[claude]

Claude finished @ian-flores's task —— View job

---

Review Complete

• Read review guidelines
• Create pending review
• Get diff and analyze changes
• Add inline review comments (submitted as general review - inline comments not permitted)
• Submit review

Submitted a non-blocking review with feedback on the implementation. The PR follows established patterns well - main verification items are around label matching during testing.

[claude]

Review Summary

The implementation follows established patterns and addresses a real gap - flightdeck was the only component without a NetworkPolicy.

What looks good

• Follows existing patterns: The reconcileFlightdeckNetworkPolicy function mirrors the structure of reconcileHomeNetworkPolicy - using KubernetesInstanceLabelKey for pod selection and allowing all egress with restricted ingress.
• Cleanup properly handled: flightdeck added to the cleanup list in alphabetical order.
• Port constant: DefaultPortFlightdeckHTTP (8080) added correctly in tcpport.go.
• Correct reconciliation order: The flightdeck reconcile call is placed at the end of the chain, which is fine.

Items to verify during testing

1. Label matching (site_controller_networkpolicies.go:746-749): The pod selector uses KubernetesInstanceLabelKey (app.kubernetes.io/instance). Verify the flightdeck deployment has this label set to <site-name>-flightdeck. Some components use ComponentLabelKey instead (like workbench-session), so confirm this matches how flightdeck pods are labeled.

2. All-egress policy (site_controller_networkpolicies.go:755-757): The empty egress rule {} allows all egress, which matches home and packagemanager. This seems appropriate for a dashboard component, but worth confirming flightdeck doesn't need more restricted egress.

Minor observations

• No unit tests added, but I notice there are no existing unit tests for other network policy reconcilers either, so this is consistent with the current test coverage.

Overall, this is a clean, well-structured addition that follows existing conventions.