feat(helm): add standalone PVC templates for git-store, firmware-cache, wireguard

Three PVCs with configurable size and storageClass. Wireguard PVC is
conditional on wireguard.enabled.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

infrastructure/helm/templates/pvc-firmware-cache.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "tod.fullname" . }}-firmware-cache
+  labels:
+    {{- include "tod.labels" . | nindent 4 }}
+spec:
+  accessModes:
+    - ReadWriteOnce
+  {{- if .Values.storage.firmwareCache.storageClass }}
+  storageClassName: {{ .Values.storage.firmwareCache.storageClass | quote }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.storage.firmwareCache.size }}

infrastructure/helm/templates/pvc-git-store.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "tod.fullname" . }}-git-store
+  labels:
+    {{- include "tod.labels" . | nindent 4 }}
+spec:
+  accessModes:
+    - ReadWriteOnce
+  {{- if .Values.storage.gitStore.storageClass }}
+  storageClassName: {{ .Values.storage.gitStore.storageClass | quote }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.storage.gitStore.size }}

infrastructure/helm/templates/pvc-wireguard-config.yaml

@@ -0,0 +1,17 @@
+{{- if .Values.wireguard.enabled }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "tod.fullname" . }}-wireguard-config
+  labels:
+    {{- include "tod.labels" . | nindent 4 }}
+spec:
+  accessModes:
+    - ReadWriteOnce
+  {{- if .Values.wireguard.storageClass }}
+  storageClassName: {{ .Values.wireguard.storageClass | quote }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.wireguard.storage }}
+{{- end }}