launch: deploy daemon StatefulSet, fix neuron-rest security context, add daemon Argo CD app

- Add neuron-daemon Argo CD Application (apps/neuron-daemon.yaml) pointing to
  k8s/neuron-technologies/daemon/ on main — daemon will deploy once image is built
- Add daemon k8s manifests: StatefulSet (2 replicas, imagePullPolicy: Always),
  Service (ClusterIP :7749, session affinity), ExternalSecret (Anthropic API key from Vault)
- Fix neuron-rest runAsNonRoot: remove constraint since v0.15.3 image runs as root,
  clears the CreateContainerConfigError on the 11h-old stale pod
- Add NEURON_DAEMON_WS_URL env var to marketing deployment for chat UI connectivity
- Add neuron.neurontechnologies.ai Cloudflare DNS record and tunnel ingress rule (Terraform)

servers/legion/dns-neurontechnologies.tf

@@ -7,6 +7,15 @@
 # proxied = true enables Cloudflare proxy (CDN, DDoS, SSL termination).
 # ttl = 1 means "auto" when proxied.
 
+resource "cloudflare_record" "nt_tunnel_neuron" {
+  zone_id = local.zone_neurontechnologies_ai
+  name    = "neuron"
+  type    = "CNAME"
+  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
+  proxied = true
+  ttl     = 1
+}
+
 resource "cloudflare_record" "nt_tunnel_api" {
   zone_id = local.zone_neurontechnologies_ai
   name    = "api"