guacamole: NFS subPath — Synology exports /volume1/kubernetes root only

First pass used nfs.path=/volume1/kubernetes/guacamole/recordings,
which triggered "mount.nfs: access denied by server" on rke2-agent1.
Synology NFS export is scoped to /volume1/kubernetes; match the
working fc-desktop pattern: mount the export root and select the
subdirectory via volumeMount.subPath.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/guacamole/guacamole.yaml

@@ -201,6 +201,7 @@ spec:
           volumeMounts:
             - name: recordings
               mountPath: /var/lib/guacamole/recordings
+              subPath: guacamole/recordings
         - name: kubectl-proxy
           image: bitnami/kubectl:latest
           args:
@@ -222,7 +223,7 @@ spec:
         - name: recordings
           nfs:
             server: 10.0.58.3
-            path: /volume1/kubernetes/guacamole/recordings
+            path: /volume1/kubernetes
 ---
 apiVersion: v1
 kind: Service
@@ -318,6 +319,7 @@ spec:
               subPath: bluejay-branding-1.0.0.jar
             - name: recordings
               mountPath: /var/lib/guacamole/recordings
+              subPath: guacamole/recordings
       volumes:
         - name: guac-properties
           configMap:
@@ -328,7 +330,7 @@ spec:
         - name: recordings
           nfs:
             server: 10.0.58.3
-            path: /volume1/kubernetes/guacamole/recordings
+            path: /volume1/kubernetes
 ---
 apiVersion: v1
 kind: Service