nats: config.merge.accounts duplicates the generated accounts key and breaks the install #4084

Describe the bug

When users is non-empty, packages/apps/nats/templates/nats.yaml renders config.merge.accounts.A.users from the generated passwords and then appends .Values.config.merge verbatim (toYaml . | nindent 10). If the tenant's config.merge also carries an accounts block, the rendered HelmRelease values contain the key twice and the install fails at post-render with a YAML error instead of merging the two maps.

The combination is not exotic: once accounts are defined, NATS only enables JetStream for an account when accounts.<name>.jetstream is set, and config.merge is the only place a tenant can put that for the generated account A.

Environment

• Cozystack v1.6.1 (platform 54), nats app chart 0.0.0+007744fb7fec; the template block is unchanged on main (lines 67–80)
• on-prem, Talos

To Reproduce

apiVersion: apps.cozystack.io/v1alpha1
kind: NATS
metadata:
  name: repro
  namespace: tenant-demo
spec:
  users:
    app: {}
  config:
    merge:
      accounts:
        A:
          jetstream: enabled

Expected behaviour
The tenant's accounts entries are merged into the generated accounts map (or the chart exposes a dedicated knob for per-account JetStream), and the release installs.

Actual behaviour

Helm install failed for release tenant-rup6ev1r6z/nats-nats-test with chart [email protected]+007744fb7fec: error while running post render on files: map[string]interface {}(nil): yaml: unmarshal errors:
  line 48: mapping key "accounts" already defined at line 43

A mergeOverwrite of the generated accounts map with .Values.config.merge.accounts before rendering, with the rest of config.merge appended as today, would keep the current values contract. I can send that patch if it matches what the maintainers want.