add neuron-web phase-1 deploy on Legion

Stand up the elb-built native El landing server on Legion k3s alongside
the existing Cloud Run prod marketing site. Image is built on
gitea-runner-1 from elb-emitted .c files + native cc and pushed to
registry.neuralplatform.ai/neuron-web:dev-dfe41234. Deployment exposes
web-stage.neuralplatform.ai via Traefik + Cloudflare tunnel.

The point is to have a working local instance we can iterate against
while we redesign the CI/CD pipeline; nothing here replaces the Cloud
Run deploy yet.

* k8s/neuron-technologies/web/ — namespace, deployment, service, ingress,
  registry-pull-secret + externalsecret pulling anthropic/supabase keys
  from Vault
* apps/neuron-web.yaml — Argo CD Application
* dns-neuralplatform.tf, main.tf — CNAME + tunnel ingress for
  web-stage.neuralplatform.ai

servers/legion/k8s/neuron-technologies/web/deployment.yaml

@@ -0,0 +1,91 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: neuron-web
+  namespace: neuron-web
+  labels:
+    app: neuron-web
+    env: stage
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: neuron-web
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 0
+      maxSurge: 1
+  template:
+    metadata:
+      labels:
+        app: neuron-web
+        env: stage
+    spec:
+      imagePullSecrets:
+        - name: registry-pull-secret
+      containers:
+        - name: neuron-web
+          image: registry.neuralplatform.ai/neuron-web:dev-dfe41234
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 8080
+          env:
+            - name: NODE_ENV
+              value: production
+            - name: PORT
+              value: "8080"
+            - name: NEURON_PORT
+              value: "7772"
+            - name: LANDING_ROOT
+              value: /srv/landing
+            # Public Cloud Run env that the El runtime reads at startup.
+            - name: NEURON_LLM_0_FORMAT
+              value: anthropic
+            - name: NEURON_LLM_0_MODEL
+              value: claude-sonnet-4-5
+            - name: NEURON_LLM_0_URL
+              value: https://api.anthropic.com/v1/messages
+            - name: GCS_SHARE_BUCKET
+              value: neuron-shares-prod
+            - name: NEURON_ORIGIN
+              value: https://web-stage.neuralplatform.ai
+          envFrom:
+            - secretRef:
+                name: neuron-web-secrets
+          # The El runtime fs_writes index.html, about.html, terms.html,
+          # enterprise-terms.html into LANDING_ROOT at startup. The image
+          # ships a baseline /srv/landing layout (assets, llms.txt) but
+          # the HTML files are runtime-generated. Mount a writable
+          # emptyDir over /srv/landing so the runtime can write, while
+          # keeping the image's static layout via subPath copies — but
+          # since the image already chowns /srv/landing to the landing
+          # user, no overlay is needed for normal operation. The
+          # readOnlyRootFilesystem flag is intentionally NOT set so
+          # /srv/landing stays writable.
+          resources:
+            requests:
+              cpu: 100m
+              memory: 128Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
+          livenessProbe:
+            httpGet:
+              path: /api/health
+              port: http
+            initialDelaySeconds: 10
+            periodSeconds: 30
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /api/health
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            failureThreshold: 3
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]