add neuron-web phase-1 deploy on Legion

Stand up the elb-built native El landing server on Legion k3s alongside
the existing Cloud Run prod marketing site. Image is built on
gitea-runner-1 from elb-emitted .c files + native cc and pushed to
registry.neuralplatform.ai/neuron-web:dev-dfe41234. Deployment exposes
web-stage.neuralplatform.ai via Traefik + Cloudflare tunnel.

The point is to have a working local instance we can iterate against
while we redesign the CI/CD pipeline; nothing here replaces the Cloud
Run deploy yet.

* k8s/neuron-technologies/web/ — namespace, deployment, service, ingress,
  registry-pull-secret + externalsecret pulling anthropic/supabase keys
  from Vault
* apps/neuron-web.yaml — Argo CD Application
* dns-neuralplatform.tf, main.tf — CNAME + tunnel ingress for
  web-stage.neuralplatform.ai

servers/legion/dns-neuralplatform.tf

@@ -11,3 +11,15 @@ resource "cloudflare_record" "np_vpn" {
   proxied = true
   ttl     = 1
 }
+
+# web-stage.neuralplatform.ai — Phase 1 Legion deploy of neuron-web (the El
+# native landing server). Coexists with the Cloud Run prod marketing site
+# at neurontechnologies.ai; this lets us iterate on the native build.
+resource "cloudflare_record" "np_web_stage" {
+  zone_id = local.zone_neuralplatform_ai
+  name    = "web-stage"
+  type    = "CNAME"
+  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
+  proxied = true
+  ttl     = 1
+}