refactor: drop istio mesh egress, use cilium FQDN for znc egress filtering

Istio ambient cannot do hostname-based egress filtering without L7
processing (waypoint/sidecar). Cilium FQDN CiliumNetworkPolicy is the
right tool — DNS-aware L3/L4 enforcement.

- Remove waypoint deployment and namespace/service label references
- Move TheLounge HTTPRoute back to Cilium external gateway
- Add CiliumNetworkPolicy for znc: allow DNS + irc.passthepopcorn.me:6697
- Remove orphaned znc/egress.yaml (Istio VirtualService routing)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

thelounge/httproute.yaml

@@ -5,7 +5,7 @@ metadata:
   namespace: irc
 spec:
   parentRefs:
-    - name: istio-external
+    - name: external
       namespace: gateway-system
   hostnames:
     - ${THELOUNGE_HOSTNAME}

thelounge/service.yaml

@@ -6,7 +6,6 @@ metadata:
   name: thelounge
   labels:
     app.kubernetes.io/name: thelounge
-    istio.io/use-waypoint: waypoint
 spec:
   type: ClusterIP
   ports: