fix: set non-LoadBalancer services to ClusterIP

The http (5280), telnet (5582), and web2 (8080) Services were hardcoded
as NodePort, exposing them on every node's IP. Only s2s (5222/5269)
needs external exposure and remains LoadBalancer. Switch the three
internal services to ClusterIP so they are reachable only via ingress or
within the cluster. Also update the unused service.type value in
values.yaml to ClusterIP so NOTES.txt lands in the port-forward branch
instead of the stale NodePort branch.

Part-of: <http://gitlab.vnc.biz/uxf/vnctalk-prosody/-/merge_requests/3>

helm/prosody/templates/service.yaml

@@ -9,7 +9,7 @@ metadata:
     {{- toYaml . | nindent 4 }}
   {{- end }}
 spec:
-  type: NodePort
+  type: ClusterIP
   ports:
     - port: 5280
       targetPort: 5280
@@ -59,7 +59,7 @@ metadata:
   {{- end }}
   {{- end }}
 spec:
-  type: NodePort
+  type: ClusterIP
   ports:
     - port: 5582
       targetPort: 5582
@@ -79,7 +79,7 @@ metadata:
     {{- toYaml . | nindent 4 }}
   {{- end }}
 spec:
-  type: NodePort
+  type: ClusterIP
   ports:
     - port: 8080
       targetPort: 8080

helm/prosody/values.yaml

@@ -47,7 +47,7 @@ dbMigration:
   enabled: true
 
 service:
-  type: NodePort
+  type: ClusterIP
   port: 5280
   annotations: {}