ente-photos 0.2.0: fix public album sharing (#2), add custom CA support (#1)

[uro]

Summary

Fixes two reported issues in the ente-photos chart and ships v0.2.0.

Fix #1 — custom CA for outbound TLS (S3, SMTP, OIDC)

Adds a new museum.customCA block that mounts a PEM bundle from an existing Secret or ConfigMap at /etc/ssl/certs/custom-ca-bundle.crt and points SSL_CERT_FILE at it. Go's crypto/x509 reads SSL_CERT_FILE automatically, so the museum trusts private CAs without rebuilding the image or running an init container.

museum:
  customCA:
    enabled: true
    existingSecret: ente-custom-ca   # or existingConfigMap
    key: ca.crt

Fix #2 — public album sharing landed on a login page

Root cause was bigger than the issue suggested. ghcr.io/ente-io/web is a single nginx image that serves each frontend on a separate internal port (photos=3000, accounts=3001, albums=3002, auth=3003, cast=3004, share=3005). The chart hard-coded containerPort: 3000 for every web.* block, so accounts/auth/cast/share were all silently running the photos app, and there was no albums component at all — which is why `albums.` always landed on the photos login page.

This PR:

• Adds a new web.albums component (port 3002) — the only frontend that knows how to render a ?t=TOKEN public album link.
• Fixes default containerPort for accounts (3001), auth (3003), cast (3004), share (3005).
• Auto-derives museum.config.apps.publicAlbums / publicLocker / accounts from the matching web.<app>.ingress.hosts[0]. No more keeping three places in sync by hand.
• Empties the placeholder `*.ente.local` defaults in values.yaml so auto-derive kicks in by default.
• Updates schema and README; adds a port-mapping table.

Also rolls up

• fix(ente-photos): use URL-safe base64 for jwt secret #3 (already merged on main) — JWT secret URL-safe base64 fix is reflected in the 0.2.0 changelog.

Test plan

• `helm lint charts/ente-photos` clean
• `helm template … | kubectl apply --dry-run=client -f -` validates with 22 resources rendered
• Verified `web.albums` deployment renders with `containerPort: 3002` and `ENTE_API_ORIGIN` / `ENTE_ALBUMS_ORIGIN` env vars
• Verified `SSL_CERT_FILE` env var and `/etc/ssl/certs/custom-ca-bundle.crt` volume mount when `museum.customCA.enabled=true`
• Verified `apps.publicAlbums: "https://albums.example.com"\` is auto-derived from `web.albums.ingress.hosts[0]`
• Real cluster smoke test — generate public album link in photos UI, open it on the configured albums domain, confirm the album loads (rather than login screen)

Closes #1
Closes #2