add alpha/beta/gamma subdomains on neurontechnologies.ai

- Tunnel ingress rules for alpha/beta/gamma.neurontechnologies.ai
- DNS CNAME records pointing to legion tunnel
- k8s ingress rules routing to neuron-alpha/beta/gamma services (port 8001)
- TLS certs via cert-manager for new hostnames

servers/legion/main.tf

@@ -180,6 +180,33 @@ resource "cloudflare_zero_trust_tunnel_cloudflared_config" "legion" {
       }
     }
 
+    # alpha.neurontechnologies.ai — experiment zone 1 (CI auto-deploys here)
+    ingress_rule {
+      hostname = "alpha.neurontechnologies.ai"
+      service  = "https://traefik.kube-system.svc:443"
+      origin_request {
+        no_tls_verify = true
+      }
+    }
+
+    # beta.neurontechnologies.ai — experiment zone 2
+    ingress_rule {
+      hostname = "beta.neurontechnologies.ai"
+      service  = "https://traefik.kube-system.svc:443"
+      origin_request {
+        no_tls_verify = true
+      }
+    }
+
+    # gamma.neurontechnologies.ai — experiment zone 3
+    ingress_rule {
+      hostname = "gamma.neurontechnologies.ai"
+      service  = "https://traefik.kube-system.svc:443"
+      origin_request {
+        no_tls_verify = true
+      }
+    }
+
     # sign.neurontechnologies.ai — Docuseal e-signature
     ingress_rule {
       hostname = "sign.neurontechnologies.ai"