Fix gitea_domain variable and add VPN/Headscale infrastructure

- Fix gitea_domain default from git.neuralplatform.dev → git.neuralplatform.ai
  so Traefik serves the correct Let's Encrypt cert when accessed via VPN/LAN
- Add docs/vpn-comparison.md: full evaluation of WireGuard/Tailscale/Headscale/Netbird/Netmaker

servers/legion/gitea.tf

@@ -1,5 +1,5 @@
 # Gitea — local git server for private/sensitive infrastructure repos
-# Accessible at git.neuralplatform.dev (internal only, real TLS)
+# Accessible at git.neuralplatform.ai (internal only, real TLS)
 
 resource "kubernetes_config_map" "gitea_custom_css" {
   metadata {

servers/legion/variables.tf

@@ -37,7 +37,7 @@ variable "cloudflare_email" {
 variable "gitea_domain" {
   description = "Domain for Gitea git server"
   type        = string
-  default     = "git.neuralplatform.dev"
+  default     = "git.neuralplatform.ai"
 }
 
 variable "gitea_admin_password" {