fix(wireguard): Allow egress to Traefik pod ports

Traffic to the 192.168.2.5 external IP is DNATed to the Traefik pod
before NetworkPolicy is evaluated, so the 10.0.0.0/8 exclusion blocked
VPN clients from reaching services behind the gateway.

apps/wireguard/networkpolicy.yaml

@@ -17,6 +17,18 @@ spec:
           podSelector:
             matchLabels:
               k8s-app: kube-dns
+    - ports:
+        - port: 8000
+          protocol: TCP
+        - port: 8443
+          protocol: TCP
+      to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: traefik
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: traefik
     - to:
         - ipBlock:
             cidr: 192.168.2.0/24