fix(wordpress): move to PHP 8.5.12 for PHP2Shell

CVE-2026-109618 and CVE-2026-109619 (BSI BITS-H 2026-297981-1132) allow
unauthenticated RCE on every PHP before 8.5.12/8.4.27/8.3.36/8.2.35;
mod_php is the highest-risk variant. The running pod reports PHP 8.3.35
and www.renner.uno serves / to the internet without the Authentik gate.

Switch to the php8.5-apache variant of the same WordPress release,
pinned to the index digest rebuilt on 2026-10-22 after the PHP fix.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

kubernetes/apps/wordpress/deployment.yaml

@@ -25,7 +25,7 @@ spec:
         fsGroup: 33
       containers:
         - name: wordpress
-          image: wordpress:7.1.3-php8.3-apache@sha256:8ecd8d8e374167ea22235acf30f80d1165b82f07ffa5bcef90c1cad8f7be251f
+          image: wordpress:7.1.3-php8.5-apache@sha256:ce31904fa1e51b73543fa2e35cc8f1747589b2abf48dc747b422749b88b77e9e
           ports:
             - name: http
               containerPort: 80

opentofu/unifi_nat_hairpin.tf

@@ -68,14 +68,13 @@ locals {
   # idx is a static per-network slot for rule_index derivation — never
   # reuse a freed idx for a new network.
   #
-  # Deliberately absent: (40) Server idx=4, (49) k8s Ceph idx=6,
-  # (46) k8s Node, (47) k8s Ingress and (48) k8s Pod. The cluster nodes
-  # have interfaces on those VLANs (mgmt0, node0, ingress0, pod0), so a
-  # DNATed flow's reply would go directly over the shared L2 and bypass
-  # the UDM's conntrack (asymmetric, connection drops) — and clients there
-  # are the nodes themselves, whose DNS chain (CoreDNS -> k8s_gateway)
-  # already resolves the public names in-cluster. idx=5 stays reserved
-  # (its network, (42) Ingress, no longer exists).
+  # Deliberately absent: (40) Server idx=4, (42) Ingress idx=5, and
+  # (49) k8s Ceph idx=6. The cluster nodes have interfaces on those VLANs,
+  # so a DNATed flow's reply would go directly over the shared L2 and
+  # bypass the UDM's conntrack (asymmetric, connection drops) — and
+  # clients there are the nodes themselves, whose DNS chain (CoreDNS ->
+  # k8s_gateway) already resolves the public names in-cluster. Their idx
+  # slots stay reserved.
   hairpin_networks = {
     "Default"              = { id = "5d4fba77ce63ee614841d53d", idx = 0 }
     "(10) Management"      = { id = "600334abf9ee0c059da6be8f", idx = 1 }