Cut over Vault and Gitea traffic from GCE/Legion to GKE

Vault:
- Annotate vault-helm-gke Service with cloud.google.com/neg exposed_ports
  to create container-native NEGs (k8s1-bfbeff02-vault-...) in 3 zones
- Add vault-api-from-lb-gke firewall rule allowing GCP health check ranges
  (130.211.0.0/22, 35.191.0.0/16) to reach GKE pod IPs on port 8200
- Replace GCE instance group backends in google_compute_backend_service.vault
  with GKE NEG backends (RATE balancing mode, 100 req/endpoint)
- GCP Global HTTPS LB frontend unchanged — DNS stays at 34.54.164.21
- vault.neuralplatform.ai now terminates at GKE pods (all 3 NEGs HEALTHY)

Gitea:
- Change GKE Gitea Service from ClusterIP to LoadBalancer (external IP: 34.31.145.131)
- Add Cloudflare DNS A record for git.neuralplatform.ai → 34.31.145.131 (proxied)
- Remove git.neuralplatform.ai route from Legion Cloudflare tunnel config
- Add Cloudflare config rule: flexible SSL for git.neuralplatform.ai
  (origin serves HTTP/3000, CF proxies HTTPS termination)
- Scale Legion Gitea deployment to 0 replicas (PVC preserved)
- git.neuralplatform.ai now serves from GKE Gitea pod

servers/gcp/k8s/argocd-apps/vault-helm-gke.yaml

@@ -131,6 +131,14 @@ spec:
             type: ClusterIP
             port: 8200
             targetPort: 8200
+            annotations:
+              # Container-native NEG for GCP Global HTTPS LB backend cutover.
+              # GKE will create a zonal NEG named k8s1-<hash>-vault-vault-helm-gke-8200-<hash>
+              # in each zone where Vault pods are scheduled.
+              # After this syncs, list NEGs:
+              #   gcloud compute network-endpoint-groups list --filter="name~vault" --project neuron-785695
+              # Then reference them in servers/gcp/vault-gke-lb.tf.
+              cloud.google.com/neg: '{"exposed_ports":{"8200":{}}}'
 
           # Ingress disabled — Vault is exposed via GCP HTTPS LB.
           # After migration, update the existing LB backend (vault-nodes.tf)