Cut over Vault and Gitea traffic from GCE/Legion to GKE

Vault:
- Annotate vault-helm-gke Service with cloud.google.com/neg exposed_ports
  to create container-native NEGs (k8s1-bfbeff02-vault-...) in 3 zones
- Add vault-api-from-lb-gke firewall rule allowing GCP health check ranges
  (130.211.0.0/22, 35.191.0.0/16) to reach GKE pod IPs on port 8200
- Replace GCE instance group backends in google_compute_backend_service.vault
  with GKE NEG backends (RATE balancing mode, 100 req/endpoint)
- GCP Global HTTPS LB frontend unchanged — DNS stays at 34.54.164.21
- vault.neuralplatform.ai now terminates at GKE pods (all 3 NEGs HEALTHY)

Gitea:
- Change GKE Gitea Service from ClusterIP to LoadBalancer (external IP: 34.31.145.131)
- Add Cloudflare DNS A record for git.neuralplatform.ai → 34.31.145.131 (proxied)
- Remove git.neuralplatform.ai route from Legion Cloudflare tunnel config
- Add Cloudflare config rule: flexible SSL for git.neuralplatform.ai
  (origin serves HTTP/3000, CF proxies HTTPS termination)
- Scale Legion Gitea deployment to 0 replicas (PVC preserved)
- git.neuralplatform.ai now serves from GKE Gitea pod

servers/gcp/k8s/gitea/deployment.yaml

@@ -142,14 +142,20 @@ kind: Service
 metadata:
   name: gitea
   namespace: gitea
+  annotations:
+    # External GCP Network LB — Cloudflare proxies in front, provides TLS.
+    # After provisioning, get the external IP:
+    #   kubectl --context=gke_neuron-785695_us-central1_neuron-platform -n gitea get svc gitea
+    # Update Cloudflare DNS A record for git.neuralplatform.ai to this IP.
+    cloud.google.com/load-balancer-type: "External"
 spec:
   selector:
     app: gitea
   ports:
     - name: http
-      port: 3000
+      port: 80
       targetPort: 3000
     - name: ssh
       port: 22
       targetPort: 22
-  type: ClusterIP
+  type: LoadBalancer