launch: deploy daemon StatefulSet, fix neuron-rest security context, add daemon Argo CD app

- Add neuron-daemon Argo CD Application (apps/neuron-daemon.yaml) pointing to
  k8s/neuron-technologies/daemon/ on main — daemon will deploy once image is built
- Add daemon k8s manifests: StatefulSet (2 replicas, imagePullPolicy: Always),
  Service (ClusterIP :7749, session affinity), ExternalSecret (Anthropic API key from Vault)
- Fix neuron-rest runAsNonRoot: remove constraint since v0.15.3 image runs as root,
  clears the CreateContainerConfigError on the 11h-old stale pod
- Add NEURON_DAEMON_WS_URL env var to marketing deployment for chat UI connectivity
- Add neuron.neurontechnologies.ai Cloudflare DNS record and tunnel ingress rule (Terraform)

servers/legion/apps/neuron-daemon.yaml

@@ -0,0 +1,20 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: neuron-daemon
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: http://10.43.1.53:3000/will/infrastructure.git
+    targetRevision: main
+    path: servers/legion/k8s/neuron-technologies/daemon
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: neuron-prod
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=false

servers/legion/dns-neurontechnologies.tf

@@ -7,6 +7,15 @@
 # proxied = true enables Cloudflare proxy (CDN, DDoS, SSL termination).
 # ttl = 1 means "auto" when proxied.
 
+resource "cloudflare_record" "nt_tunnel_neuron" {
+  zone_id = local.zone_neurontechnologies_ai
+  name    = "neuron"
+  type    = "CNAME"
+  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
+  proxied = true
+  ttl     = 1
+}
+
 resource "cloudflare_record" "nt_tunnel_api" {
   zone_id = local.zone_neurontechnologies_ai
   name    = "api"

servers/legion/k8s/neuron-technologies/daemon/externalsecret.yaml

@@ -0,0 +1,23 @@
+# Populate Vault before first deploy:
+#
+#   vault kv put secret/neuron-technologies/daemon \
+#     anthropic_api_key="sk-ant-..."
+
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: neuron-daemon-secrets
+  namespace: neuron-prod
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: vault
+    kind: ClusterSecretStore
+  target:
+    name: neuron-daemon-secrets
+    creationPolicy: Owner
+  data:
+    - secretKey: ANTHROPIC_API_KEY
+      remoteRef:
+        key: secret/data/neuron-technologies/daemon
+        property: anthropic_api_key

servers/legion/k8s/neuron-technologies/daemon/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - externalsecret.yaml
+  - statefulset.yaml
+  - service.yaml

servers/legion/k8s/neuron-technologies/daemon/service.yaml

@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: neuron-daemon
+  namespace: neuron-prod
+  labels:
+    app: neuron-daemon
+spec:
+  selector:
+    app: neuron-daemon
+  ports:
+    - name: ws
+      port: 7749
+      targetPort: 7749
+  type: ClusterIP
+  sessionAffinity: ClientIP
+  sessionAffinityConfig:
+    clientIP:
+      timeoutSeconds: 86400

servers/legion/k8s/neuron-technologies/daemon/statefulset.yaml

@@ -0,0 +1,81 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: neuron-daemon
+  namespace: neuron-prod
+  labels:
+    app: neuron-daemon
+    env: prod
+spec:
+  serviceName: neuron-daemon
+  replicas: 2
+  selector:
+    matchLabels:
+      app: neuron-daemon
+  template:
+    metadata:
+      labels:
+        app: neuron-daemon
+        env: prod
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1001
+        fsGroup: 1001
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: neuron-daemon
+          image: registry.neuralplatform.ai/neuron-technologies/neuron-daemon:latest
+          imagePullPolicy: Always
+          ports:
+            - name: ws
+              containerPort: 7749
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: false
+            runAsNonRoot: true
+            capabilities:
+              drop: ["ALL"]
+          env:
+            - name: NEURON_LLM_PROVIDER
+              value: anthropic
+            - name: NEURON_LLM_MODEL
+              value: claude-haiku-4-5
+            - name: NEURON_DATA_DIR
+              value: /data
+          envFrom:
+            - secretRef:
+                name: neuron-daemon-secrets
+          volumeMounts:
+            - name: data
+              mountPath: /data
+          resources:
+            requests:
+              cpu: 500m
+              memory: 1Gi
+            limits:
+              cpu: 2000m
+              memory: 2Gi
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 7749
+            initialDelaySeconds: 30
+            periodSeconds: 30
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 7749
+            initialDelaySeconds: 20
+            periodSeconds: 10
+            failureThreshold: 3
+  volumeClaimTemplates:
+    - metadata:
+        name: data
+      spec:
+        accessModes: ["ReadWriteOnce"]
+        resources:
+          requests:
+            storage: 5Gi

servers/legion/k8s/neuron-technologies/marketing/deployment.yaml

@@ -40,6 +40,8 @@ spec:
               value: production
             - name: NEURON_LICENSE_API_URL
               value: http://neuron-license.neuron-prod.svc.cluster.local:8082
+            - name: NEURON_DAEMON_WS_URL
+              value: ws://neuron-daemon.neuron-prod.svc.cluster.local:7749/ws
           envFrom:
             - secretRef:
                 name: neuron-marketing-secrets

servers/legion/k8s/neuron-technologies/prod/rest-deployment.yaml

@@ -20,7 +20,6 @@ spec:
         kubectl.kubernetes.io/restartedAt: "2026-04-24T10:00:00Z"
     spec:
       securityContext:
-        runAsNonRoot: true
         seccompProfile:
           type: RuntimeDefault
       containers:
@@ -33,7 +32,6 @@ spec:
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: false
-            runAsNonRoot: true
             capabilities:
               drop: ["ALL"]
           envFrom:

servers/legion/main.tf

@@ -149,6 +149,15 @@ resource "cloudflare_zero_trust_tunnel_cloudflared_config" "legion" {
       service  = "ssh://localhost:30022"
     }
 
+    # neuron.neurontechnologies.ai — Neuron MCP (private, neuron-prod namespace)
+    ingress_rule {
+      hostname = "neuron.neurontechnologies.ai"
+      service  = "https://traefik.kube-system.svc:443"
+      origin_request {
+        no_tls_verify = true
+      }
+    }
+
     # neurontechnologies.ai — Neuron Technologies prod (neuron-prod namespace)
     ingress_rule {
       hostname = "neurontechnologies.ai"