launch: deploy daemon StatefulSet, fix neuron-rest security context, add daemon Argo CD app

- Add neuron-daemon Argo CD Application (apps/neuron-daemon.yaml) pointing to
  k8s/neuron-technologies/daemon/ on main — daemon will deploy once image is built
- Add daemon k8s manifests: StatefulSet (2 replicas, imagePullPolicy: Always),
  Service (ClusterIP :7749, session affinity), ExternalSecret (Anthropic API key from Vault)
- Fix neuron-rest runAsNonRoot: remove constraint since v0.15.3 image runs as root,
  clears the CreateContainerConfigError on the 11h-old stale pod
- Add NEURON_DAEMON_WS_URL env var to marketing deployment for chat UI connectivity
- Add neuron.neurontechnologies.ai Cloudflare DNS record and tunnel ingress rule (Terraform)

servers/legion/main.tf

@@ -149,6 +149,15 @@ resource "cloudflare_zero_trust_tunnel_cloudflared_config" "legion" {
       service  = "ssh://localhost:30022"
     }
 
+    # neuron.neurontechnologies.ai — Neuron MCP (private, neuron-prod namespace)
+    ingress_rule {
+      hostname = "neuron.neurontechnologies.ai"
+      service  = "https://traefik.kube-system.svc:443"
+      origin_request {
+        no_tls_verify = true
+      }
+    }
+
     # neurontechnologies.ai — Neuron Technologies prod (neuron-prod namespace)
     ingress_rule {
       hostname = "neurontechnologies.ai"