Cut over Vault and Gitea traffic from GCE/Legion to GKE

Vault:
- Annotate vault-helm-gke Service with cloud.google.com/neg exposed_ports
  to create container-native NEGs (k8s1-bfbeff02-vault-...) in 3 zones
- Add vault-api-from-lb-gke firewall rule allowing GCP health check ranges
  (130.211.0.0/22, 35.191.0.0/16) to reach GKE pod IPs on port 8200
- Replace GCE instance group backends in google_compute_backend_service.vault
  with GKE NEG backends (RATE balancing mode, 100 req/endpoint)
- GCP Global HTTPS LB frontend unchanged — DNS stays at 34.54.164.21
- vault.neuralplatform.ai now terminates at GKE pods (all 3 NEGs HEALTHY)

Gitea:
- Change GKE Gitea Service from ClusterIP to LoadBalancer (external IP: 34.31.145.131)
- Add Cloudflare DNS A record for git.neuralplatform.ai → 34.31.145.131 (proxied)
- Remove git.neuralplatform.ai route from Legion Cloudflare tunnel config
- Add Cloudflare config rule: flexible SSL for git.neuralplatform.ai
  (origin serves HTTP/3000, CF proxies HTTPS termination)
- Scale Legion Gitea deployment to 0 replicas (PVC preserved)
- git.neuralplatform.ai now serves from GKE Gitea pod

servers/legion/dns-neuralplatform.tf

@@ -24,9 +24,9 @@ resource "cloudflare_record" "np_web_stage" {
   ttl     = 1
 }
 
-# vault.neuralplatform.ai — GCE Raft HA Vault cluster via GCP Global HTTPS LB.
+# vault.neuralplatform.ai — GCP Global HTTPS LB with managed cert.
 # DNS-only (not proxied) — GCP managed TLS cert terminates at the LB.
-# Vault nodes listen on plain HTTP 8200 internally; LB does TLS.
+# Backend is now GKE container-native NEGs (cut over from GCE instance groups).
 # IP: terraform output vault_lb_ip from servers/gcp workspace = 34.54.164.21
 resource "cloudflare_record" "np_vault" {
   zone_id = local.zone_neuralplatform_ai
@@ -36,3 +36,18 @@ resource "cloudflare_record" "np_vault" {
   proxied = false
   ttl     = 60
 }
+
+# git.neuralplatform.ai — Gitea on GKE via GCP Network LB.
+# Cloudflare proxied (provides TLS termination). Gitea listens on port 80 internally.
+# IP: external IP of the GKE LoadBalancer service in namespace gitea.
+# Get it with:
+#   kubectl --context=gke_neuron-785695_us-central1_neuron-platform -n gitea get svc gitea
+# Update content below with the actual IP, then terraform apply.
+resource "cloudflare_record" "np_gitea" {
+  zone_id = local.zone_neuralplatform_ai
+  name    = "git"
+  type    = "A"
+  content = "34.31.145.131"  # GKE LoadBalancer external IP — gitea svc in namespace gitea
+  proxied = true
+  ttl     = 1
+}