feat(helm): support Deployment workload type for LoadBalancer mode

Add workloadType: DaemonSet | Deployment and replicaCount values.
DaemonSet is default (bare-metal k3s + hostPorts). Deployment is
recommended with service.type: LoadBalancer (MetalLB / cloud LBs) —
set hostPorts.enabled: false in that case to avoid port conflicts.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: brdelphus

helm/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: caddy
 description: Caddy ingress with WAF, TCP/UDP, cert-manager CSI, CrowdSec, GeoIP, rate limiting and caching
 type: application
-version: 0.2.0
+version: 0.3.0
 appVersion: "2.11.2"
 keywords:
   - caddy

helm/templates/daemonset.yaml

@@ -1,5 +1,6 @@
+{{- $isDaemonSet := ne .Values.workloadType "Deployment" -}}
 apiVersion: apps/v1
-kind: DaemonSet
+kind: {{ if $isDaemonSet }}DaemonSet{{ else }}Deployment{{ end }}
 metadata:
   name: {{ include "caddy.fullname" . }}
   namespace: {{ .Release.Namespace }}
@@ -14,8 +15,14 @@ spec:
   selector:
     matchLabels:
       {{- include "caddy.selectorLabels" . | nindent 6 }}
+  {{- if $isDaemonSet }}
   updateStrategy:
     type: RollingUpdate
+  {{- else }}
+  replicas: {{ .Values.replicaCount }}
+  strategy:
+    type: RollingUpdate
+  {{- end }}
   template:
     metadata:
       labels:

helm/values.yaml

@@ -233,6 +233,15 @@ service:
     # GCE internal LB:
     # cloud.google.com/load-balancer-type: Internal
 
+# ── Workload type ─────────────────────────────────────────────────────────────
+# DaemonSet  — runs on every node; use with hostPorts for bare-metal k3s.
+# Deployment — fixed replica count; use with service.type: LoadBalancer (MetalLB,
+#              cloud LBs). Set hostPorts.enabled: false when using a LoadBalancer
+#              so pods don't compete for node ports.
+
+workloadType: DaemonSet   # DaemonSet | Deployment
+replicaCount: 2           # only used when workloadType: Deployment
+
 # ── DaemonSet / pod settings ───────────────────────────────────────────────────
 # hostPorts bind directly on each node's network interface.
 # Can coexist with the LoadBalancer service — disable if your LB provider