fix(helm): review round 1 — scoped example egress, in-tab secret note, copilot Job wording

- external-db example egress scopes to a placeholder database CIDR instead of
  to: [] (which allowed every destination on 5432, defeating the isolation
  the example teaches)
- kubernetes.mdx cloud tabs state explicitly that they reuse the variables
  generated in the Installation block
- Copilot migrations really do run as a Helm-hook Job — restore Job wording
  there (only the app migrations are an init container)

Author: waleedlatif1

apps/docs/content/docs/en/platform/self-hosting/kubernetes.mdx

@@ -38,6 +38,8 @@ helm install sim ./helm/sim \
 
 ## Cloud-Specific Values
 
+These commands reuse the `$BETTER_AUTH_SECRET`, `$ENCRYPTION_KEY`, `$INTERNAL_API_SECRET`, `$CRON_SECRET`, and `$POSTGRES_PASSWORD` variables generated in [Installation](#installation) above — run that block's `openssl` lines first in the same shell.
+
 <Tabs items={['AWS EKS', 'Azure AKS', 'GCP GKE']}>
   <Tab value="AWS EKS">
 ```bash

helm/sim/examples/values-external-db.yaml

@@ -175,7 +175,11 @@ networkPolicy:
   # external DB on a different port (or off-cluster), add an egress rule.
   # `networkPolicy.egress` is a LIST of NetworkPolicy egress rules.
   egress:
-    - to: []
+    - to:
+        # Scope to YOUR database's subnet — an empty `to:` would allow the pods
+        # to reach ANY host on 5432, defeating the isolation this teaches.
+        - ipBlock:
+            cidr: 10.0.0.0/16 # replace with your database subnet or /32 host CIDR
       ports:
         - protocol: TCP
           port: 5432

helm/sim/values.yaml

@@ -1674,9 +1674,10 @@ copilot:
     secretKey: DATABASE_URL
     url: ""
 
-  # Migration job configuration
+  # Migration job configuration (Copilot migrations run as a Helm-hook Job,
+  # unlike the app migrations which run as an init container)
   migrations:
-    # Enable/disable the migrations init container
+    # Enable/disable the Copilot migrations Job
     enabled: true
 
     # Image configuration (same as server)