Fix Neuron MCP: runAsUser + move to neuron.neurontechnologies.ai

Pod was crash-looping: image has no USER directive so kubelet rejected it
with runAsNonRoot. Add runAsUser: 1000 at both pod and container level.

MCP paths moved from neurontechnologies.ai (now a GCP Cloud Run A record,
unreachable on Legion) to private subdomain neuron.neurontechnologies.ai.
Cloudflare tunnel and DNS CNAME updated out-of-band.

servers/legion/k8s/neuron-technologies/prod/ingress.yaml

@@ -13,8 +13,9 @@ spec:
       hosts:
         - neurontechnologies.ai
         - www.neurontechnologies.ai
+        - neuron.neurontechnologies.ai
   rules:
-    - host: neurontechnologies.ai
+    - host: neuron.neurontechnologies.ai
       http:
         paths:
           - path: /mcp
@@ -66,6 +67,9 @@ spec:
                 name: neuron-mcp
                 port:
                   number: 8080
+    - host: neurontechnologies.ai
+      http:
+        paths:
           - path: /license
             pathType: Prefix
             backend:

servers/legion/k8s/neuron-technologies/prod/mcp-deployment.yaml

@@ -21,12 +21,11 @@ spec:
         app: neuron-mcp
         slot: blue
         env: prod
-      annotations:
-        kubectl.kubernetes.io/restartedAt: "2026-04-25T08:40:00Z"
     spec:
       terminationGracePeriodSeconds: 30
       securityContext:
         runAsNonRoot: true
+        runAsUser: 1000
         seccompProfile:
           type: RuntimeDefault
       containers:
@@ -40,6 +39,7 @@ spec:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: false  # JVM writes temp files; restrict paths via allowedPaths once profiled
             runAsNonRoot: true
+            runAsUser: 1000
             capabilities:
               drop: ["ALL"]
           env: