chart: bind the HTTPRoute to a named gateway listener

The route carried no sectionName, so it attached to every listener whose
hostname matched — including the hostname-less plaintext HTTP listener.
On a publicly reachable hostname that means the API accepts bearer tokens
over cleartext.

networking.listener names the listener to bind to. It defaults to empty,
which keeps the previous attach-to-all behaviour.

Also document the Kubernetes install path, which the README omitted.

charts/terdut-server/values.yaml

@@ -1,6 +1,10 @@
 networking:
   hostname: "terdut.example.com"
   servicePort: 8080
+  # Gateway listener to bind the HTTPRoute to. Empty attaches to every matching
+  # listener, including plaintext HTTP. Set this to the name of the HTTPS
+  # listener to serve the API over TLS only.
+  listener: ""
 
 image:
   repository: ghcr.io/yeniklas/terdut-server