Migrate k8s config from Terraform to Argo CD + ESO

Phase 1: Install External Secrets Operator via Argo CD app
- apps/external-secrets.yaml — ESO Helm chart install
- apps/external-secrets-config.yaml — ClusterSecretStore deployment
- k8s/external-secrets/cluster-secret-store.yaml — Vault backend using vault-token Secret

Phase 2: Create k8s manifests for all services
- k8s/neuron/ — PVC, ConfigMap, ExternalSecrets (neuron-secrets, cloudflared-secret), Ingress
- k8s/gitea/ — PVC, ConfigMap (custom CSS), ExternalSecret (gitea-db), Ingress
- k8s/github-runner/ — ExternalSecret (github-runner-secret)
- k8s/gitea-runner/ — ExternalSecret (gitea-runner-secret)
- k8s/monitoring/ — ExternalSecrets (grafana, slack), Alloy OTLP service+middleware, datasources ConfigMap, Ingress
- k8s/postgres/ — ExternalSecret (postgres-passwords)
- k8s/vault/ — ExternalSecret (vault-gcp-sa from Vault)
- k8s/adguard/ — PVCs, ConfigMap, Certificate, Ingress, ddclient Deployment+ExternalSecret
- k8s/ollama/ — PVC, Ingress
- k8s/headscale/ — PVC
- k8s/packages/ — PVCs, ConfigMap, Ingresses
- k8s/registry/ — PVC, Ingresses
- k8s/backup/ — CronJob, ExternalSecret (backup-credentials)

New Argo CD apps for Helm releases:
- apps/kube-prometheus-stack.yaml, loki.yaml, tempo.yaml, alloy.yaml
- apps/postgres.yaml, redis.yaml, vault.yaml

New Argo CD apps for k8s config paths:
- apps/neuron-config, gitea-config, ci-config, gitea-runner-config
- apps/monitoring-config, adguard-config, ollama-config, headscale-config
- apps/packages-config, registry-config, postgres-config, vault-config, backup

Phase 3: Strip Terraform to infrastructure-only
- All kubernetes_* and helm_release resources removed from service .tf files
- Each service .tf now contains only kubernetes_namespace (bootstrap dependency)
- variables.tf stripped to only cloudflare_api_key, cloudflare_email, gitea_api_token
- namespaces.tf gains external-secrets namespace
- ingress.tf, backup.tf, ddclient.tf emptied (resources in k8s/)
- cert-manager.tf, argocd.tf, traefik.tf unchanged (bootstrap)

servers/legion/k8s/neuron/configmap.yaml

@@ -0,0 +1,27 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: neuron-config
+  namespace: neuron
+data:
+  MCP_PORT: "8001"
+  MCP_HOST: "0.0.0.0"
+  WEBHOOK_PORT: "3847"
+  NEURON_DB_PATH: "/data/neuron.db"
+  AXON_DB_PATH: "/data/axon.db"
+  TUNNEL_NAME: "neural-platform"
+  default.yaml: |
+    runtime:
+      name: neuron
+      version: 0.1.0
+    storage:
+      db_path: /data/neuron.db
+    cache:
+      max_l1_size: 1000
+    gc:
+      gen0_threshold: 3
+      gen1_threshold: 5
+    knowledge:
+      base_path: /data/knowledge
+    synapse:
+      path: /data/synapse

servers/legion/k8s/neuron/external-secrets.yaml

@@ -0,0 +1,52 @@
+---
+# neuron-secrets — GITHUB_WEBHOOK_SECRET, GITEA_WEBHOOK_SECRET, SLACK_BOT_TOKEN, SLACK_SIGNING_SECRET
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: neuron-secrets
+  namespace: neuron
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: vault
+    kind: ClusterSecretStore
+  target:
+    name: neuron-secrets
+    creationPolicy: Owner
+  data:
+    - secretKey: GITHUB_WEBHOOK_SECRET
+      remoteRef:
+        key: secret/data/github
+        property: webhook_secret
+    - secretKey: GITEA_WEBHOOK_SECRET
+      remoteRef:
+        key: secret/data/gitea
+        property: api_token
+    - secretKey: SLACK_BOT_TOKEN
+      remoteRef:
+        key: secret/data/slack
+        property: bot_token
+    - secretKey: SLACK_SIGNING_SECRET
+      remoteRef:
+        key: secret/data/slack
+        property: signing_secret
+---
+# cloudflared-secret — TUNNEL_TOKEN for the Cloudflare tunnel
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: cloudflared-secret
+  namespace: neuron
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: vault
+    kind: ClusterSecretStore
+  target:
+    name: cloudflared-secret
+    creationPolicy: Owner
+  data:
+    - secretKey: TUNNEL_TOKEN
+      remoteRef:
+        key: secret/data/cloudflare-tunnel
+        property: token

servers/legion/k8s/neuron/ingress.yaml

@@ -0,0 +1,25 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: neuron
+  namespace: neuron
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+spec:
+  ingressClassName: traefik
+  tls:
+    - secretName: neuron-tls
+      hosts:
+        - neuron.neuralplatform.ai
+  rules:
+    - host: neuron.neuralplatform.ai
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: neuron
+                port:
+                  number: 8001

servers/legion/k8s/neuron/pvc.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: neuron-data
+  namespace: neuron
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 5Gi