deploy: an Exoscale LoadBalancer Service is two artifacts — the gate was never opened (tablet 29)

The NLB forwards to the Service's NodePort and healthchecks it on the
node; the cloud controller does not open that port in the security
group. shorashim-external had no rule for 30923 for 26 days, so
185.19.29.180 refused connections while the pod was Ready. Rule added
by the kohen 2026-10-04; the command now sits beside the manifest.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

deploy/k8s/service.yaml

@@ -25,7 +25,14 @@ spec:
       name: http
 ---
 # External access via LoadBalancer
-# For Exoscale SKS, this provisions an Exoscale NLB
+# For Exoscale SKS, this provisions an Exoscale NLB.
+#
+# The NLB forwards to this Service's NodePort and TCP-healthchecks it on
+# the node. The cloud controller does NOT open that port in the node's
+# security group — the operator must, or the NLB IP refuses connections
+# while the pod is Ready (2026-10-04, tablet 29):
+#   PORT=$(kubectl -n shorashim get svc shorashim-external -o jsonpath='{.spec.ports[0].nodePort}')
+#   exo compute security-group rule add default --flow ingress --protocol tcp --port $PORT --network 0.0.0.0/0
 apiVersion: v1
 kind: Service
 metadata: