add neuron-web phase-1 deploy on Legion

Stand up the elb-built native El landing server on Legion k3s alongside
the existing Cloud Run prod marketing site. Image is built on
gitea-runner-1 from elb-emitted .c files + native cc and pushed to
registry.neuralplatform.ai/neuron-web:dev-dfe41234. Deployment exposes
web-stage.neuralplatform.ai via Traefik + Cloudflare tunnel.

The point is to have a working local instance we can iterate against
while we redesign the CI/CD pipeline; nothing here replaces the Cloud
Run deploy yet.

* k8s/neuron-technologies/web/ — namespace, deployment, service, ingress,
  registry-pull-secret + externalsecret pulling anthropic/supabase keys
  from Vault
* apps/neuron-web.yaml — Argo CD Application
* dns-neuralplatform.tf, main.tf — CNAME + tunnel ingress for
  web-stage.neuralplatform.ai

servers/legion/k8s/neuron-technologies/web/registry-pull-secret.yaml

@@ -0,0 +1,30 @@
+# registry-pull-secret — credentials for registry.neuralplatform.ai
+# pulled from Vault by ESO. Lets the deployment fetch
+# registry.neuralplatform.ai/neuron-web:* without baking creds into the manifest.
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: registry-pull-secret
+  namespace: neuron-web
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: vault
+    kind: ClusterSecretStore
+  target:
+    name: registry-pull-secret
+    creationPolicy: Owner
+    template:
+      type: kubernetes.io/dockerconfigjson
+      data:
+        .dockerconfigjson: |
+          {"auths":{"registry.neuralplatform.ai":{"username":"{{ .registry_user }}","password":"{{ .registry_docker_token }}","auth":"{{ list .registry_user .registry_docker_token | join ":" | b64enc }}"}}}
+  data:
+    - secretKey: registry_user
+      remoteRef:
+        key: secret/data/mudcraft
+        property: registry_user
+    - secretKey: registry_docker_token
+      remoteRef:
+        key: secret/data/mudcraft
+        property: registry_docker_token