feat(minecraft): deploy journey-into-imagination PaperMC server

- PaperMC 26.1.2 via itzg/minecraft-server:2026.7.0
- Namespace: minecraft, Service: journey-into-imagination
- TCP port 10182 (non-standard) via ingress-nginx tcp forwarding
- Pure Storage CSI PVC (pure-block, 50Gi) for world data
- World seed hardcoded: -5177989977648707969
- RCON password via ExternalSecret + 1Password Connect
- SleepMost v5.6.2 plugin for single-player sleep
- Whitelist off at launch, toggle-ready
- ExternalDNS annotations for internal Technitium record
- Manual steps: UniFi port forward WAN:10182→10.1.71.80:10182,
  Cloudflare A record + SRV for journey-into-imagination.mk-labs.cloud

cluster/platform/ingress-nginx/values.yaml

@@ -41,3 +41,18 @@ controller:
       labelSelector:
         matchLabels:
           app.kubernetes.io/name: ingress-nginx
+
+# ------------------------------------------------------------------------------
+# TCP port forwarding — raw TCP services (non-HTTP)
+# Each entry maps an external port to a namespace/service:port target.
+# The Helm chart automatically:
+#   1. Creates the tcp-services ConfigMap in the ingress-nginx namespace
+#   2. Passes --tcp-services-configmap=ingress-nginx/tcp-services to the controller
+#   3. Adds the port to the nginx-ingress LoadBalancer Service
+#
+# After ArgoCD syncs, add a UniFi port forward:
+#   WAN:10182 → 10.1.71.80:10182 (TCP)
+# Non-standard port for security (default 25565 avoided).
+# ------------------------------------------------------------------------------
+tcp:
+  10182: "minecraft/journey-into-imagination:25565"