Migrate k8s config from Terraform to Argo CD + ESO

Phase 1: Install External Secrets Operator via Argo CD app
- apps/external-secrets.yaml — ESO Helm chart install
- apps/external-secrets-config.yaml — ClusterSecretStore deployment
- k8s/external-secrets/cluster-secret-store.yaml — Vault backend using vault-token Secret

Phase 2: Create k8s manifests for all services
- k8s/neuron/ — PVC, ConfigMap, ExternalSecrets (neuron-secrets, cloudflared-secret), Ingress
- k8s/gitea/ — PVC, ConfigMap (custom CSS), ExternalSecret (gitea-db), Ingress
- k8s/github-runner/ — ExternalSecret (github-runner-secret)
- k8s/gitea-runner/ — ExternalSecret (gitea-runner-secret)
- k8s/monitoring/ — ExternalSecrets (grafana, slack), Alloy OTLP service+middleware, datasources ConfigMap, Ingress
- k8s/postgres/ — ExternalSecret (postgres-passwords)
- k8s/vault/ — ExternalSecret (vault-gcp-sa from Vault)
- k8s/adguard/ — PVCs, ConfigMap, Certificate, Ingress, ddclient Deployment+ExternalSecret
- k8s/ollama/ — PVC, Ingress
- k8s/headscale/ — PVC
- k8s/packages/ — PVCs, ConfigMap, Ingresses
- k8s/registry/ — PVC, Ingresses
- k8s/backup/ — CronJob, ExternalSecret (backup-credentials)

New Argo CD apps for Helm releases:
- apps/kube-prometheus-stack.yaml, loki.yaml, tempo.yaml, alloy.yaml
- apps/postgres.yaml, redis.yaml, vault.yaml

New Argo CD apps for k8s config paths:
- apps/neuron-config, gitea-config, ci-config, gitea-runner-config
- apps/monitoring-config, adguard-config, ollama-config, headscale-config
- apps/packages-config, registry-config, postgres-config, vault-config, backup

Phase 3: Strip Terraform to infrastructure-only
- All kubernetes_* and helm_release resources removed from service .tf files
- Each service .tf now contains only kubernetes_namespace (bootstrap dependency)
- variables.tf stripped to only cloudflare_api_key, cloudflare_email, gitea_api_token
- namespaces.tf gains external-secrets namespace
- ingress.tf, backup.tf, ddclient.tf emptied (resources in k8s/)
- cert-manager.tf, argocd.tf, traefik.tf unchanged (bootstrap)

servers/legion/neuron.tf

@@ -1,12 +1,6 @@
 # Neuron — MCP server + Axon webhook hub
-# MCP: https://neuron.nook.family (internal, Traefik)
-# Webhooks: https://axon.neuralplatform.ai (external, Cloudflare tunnel)
-#
-# Image: registry.nook.family/neural-platform/neuron:latest
-# Built by GitHub Actions runner on Legion — see neural-platform/neuron ci.yml
-#
-# TODO: Migrate SQLite → Postgres once neuron db migration is ready
-# TODO: Wire Gmail OAuth credentials via k8s Secret (currently unauthenticated)
+# Namespace only — all other resources managed by Argo CD + ESO
+# See: apps/neuron.yaml, apps/neuron-config.yaml, k8s/neuron/
 
 resource "kubernetes_namespace" "neuron" {
   metadata {
@@ -17,120 +11,3 @@ resource "kubernetes_namespace" "neuron" {
     }
   }
 }
-
-resource "kubernetes_persistent_volume_claim" "neuron_data" {
-  metadata {
-    name      = "neuron-data"
-    namespace = kubernetes_namespace.neuron.metadata[0].name
-  }
-
-  spec {
-    access_modes = ["ReadWriteOnce"]
-    resources {
-      requests = {
-        storage = "5Gi"
-      }
-    }
-  }
-}
-
-resource "kubernetes_config_map" "neuron_config" {
-  metadata {
-    name      = "neuron-config"
-    namespace = kubernetes_namespace.neuron.metadata[0].name
-  }
-
-  data = {
-    MCP_PORT       = "8001"
-    MCP_HOST       = "0.0.0.0"
-    WEBHOOK_PORT   = "3847"
-    NEURON_DB_PATH = "/data/neuron.db"
-    AXON_DB_PATH   = "/data/axon.db"
-    TUNNEL_NAME    = "neural-platform"
-
-    "default.yaml" = <<-EOT
-      runtime:
-        name: neuron
-        version: 0.1.0
-      storage:
-        db_path: /data/neuron.db
-      cache:
-        max_l1_size: 1000
-      gc:
-        gen0_threshold: 3
-        gen1_threshold: 5
-      knowledge:
-        base_path: /data/knowledge
-      synapse:
-        path: /data/synapse
-    EOT
-  }
-}
-
-resource "kubernetes_secret" "neuron_secrets" {
-  metadata {
-    name      = "neuron-secrets"
-    namespace = kubernetes_namespace.neuron.metadata[0].name
-  }
-
-  data = {
-    GITHUB_WEBHOOK_SECRET = var.github_webhook_secret
-    GITEA_WEBHOOK_SECRET  = var.gitea_webhook_secret
-    SLACK_BOT_TOKEN       = var.slack_bot_token
-    SLACK_SIGNING_SECRET  = var.slack_signing_secret
-  }
-}
-
-# Deployment + Service + cloudflared managed by Argo CD — see servers/legion/apps/neuron.yaml
-
-resource "kubernetes_secret" "cloudflared_secret" {
-  metadata {
-    name      = "cloudflared-secret"
-    namespace = kubernetes_namespace.neuron.metadata[0].name
-  }
-  data = {
-    TUNNEL_TOKEN = var.cloudflared_tunnel_token
-  }
-}
-
-# Internal MCP ingress — accessible within nook.family network
-resource "kubernetes_ingress_v1" "neuron" {
-  metadata {
-    name      = "neuron"
-    namespace = kubernetes_namespace.neuron.metadata[0].name
-    annotations = {
-      "traefik.ingress.kubernetes.io/router.entrypoints"  = "websecure"
-      "cert-manager.io/cluster-issuer"                    = "letsencrypt-prod"
-    }
-  }
-
-  spec {
-    ingress_class_name = "traefik"
-
-    tls {
-      secret_name = "neuron-tls"
-      hosts       = ["neuron.${var.infra_domain}"]
-    }
-
-    rule {
-      host = "neuron.${var.infra_domain}"
-      http {
-        path {
-          path      = "/"
-          path_type = "Prefix"
-          backend {
-            service {
-              name = "neuron"
-              port {
-                number = 8001
-              }
-            }
-          }
-        }
-      }
-    }
-  }
-
-  depends_on = [helm_release.cert_manager]
-}
-