Align 08-adding-new-apps with Gitea repo and Pod Security lesson

docs/08-adding-new-apps.md

@@ -22,9 +22,10 @@ To add a new app called, say, `whoami`:
 
 2. Create `apps/whoami.yaml`, copied from [`apps/demo.yaml`](../apps/demo.yaml)
    with the names changed: `metadata.name`, `spec.source.repoURL` (still
-   your fork — see [`docs/04-app-of-apps.md`](04-app-of-apps.md#every-application-needs-its-own-repourl)
-   for why every Application needs this set individually), `spec.source.path`
-   (→ `apps/whoami`), and `spec.destination.namespace`.
+   this cluster's public Gitea repository — see
+   [`docs/04-app-of-apps.md`](04-app-of-apps.md#every-application-needs-its-own-repourl)
+   for why every Application needs this set individually, not inherited),
+   `spec.source.path` (→ `apps/whoami`), and `spec.destination.namespace`.
 
 3. Commit and push both. That's it — no `kubectl apply`. The app-of-apps
    (already watching `apps/` — see
@@ -40,6 +41,14 @@ If your new app needs storage, request it with a plain
 itself as the cluster's default StorageClass, so it's used automatically.
 See [`docs/06-longhorn.md`](06-longhorn.md).
 
+If your new app needs `hostNetwork`, `hostPath` volumes, or privileged
+containers (uncommon, but real for things like storage or networking
+addons), Kubernetes' Pod Security Admission will reject it by default —
+see `apps/metallb.yaml` and `apps/longhorn.yaml` for the working pattern:
+an Application-level `syncPolicy.managedNamespaceMetadata.labels` opting
+just that namespace into the `privileged` profile. Ordinary apps like
+`whoami` never need this.
+
 ## Manifest-based vs. Helm-based apps
 
 `apps/demo/` is plain Kubernetes manifests — no templating, nothing to
@@ -83,7 +92,8 @@ address shows up in it.
 
 - [ ] New app's manifests live in `apps/<name>/`
 - [ ] New `apps/<name>.yaml` Application created, modeled on `demo.yaml`
-- [ ] `repoURL` set to your fork, not left as a placeholder
+- [ ] `repoURL` set to this cluster's public Gitea repository, not left as
+      a placeholder
 - [ ] Pushed to Git
 - [ ] `argocd app list` shows the new app, `Synced`/`Healthy`
 - [ ] If it has a `LoadBalancer` Service, its address is recorded in `docs/network.md`