Cut over Vault and Gitea traffic from GCE/Legion to GKE

Vault:
- Annotate vault-helm-gke Service with cloud.google.com/neg exposed_ports
  to create container-native NEGs (k8s1-bfbeff02-vault-...) in 3 zones
- Add vault-api-from-lb-gke firewall rule allowing GCP health check ranges
  (130.211.0.0/22, 35.191.0.0/16) to reach GKE pod IPs on port 8200
- Replace GCE instance group backends in google_compute_backend_service.vault
  with GKE NEG backends (RATE balancing mode, 100 req/endpoint)
- GCP Global HTTPS LB frontend unchanged — DNS stays at 34.54.164.21
- vault.neuralplatform.ai now terminates at GKE pods (all 3 NEGs HEALTHY)

Gitea:
- Change GKE Gitea Service from ClusterIP to LoadBalancer (external IP: 34.31.145.131)
- Add Cloudflare DNS A record for git.neuralplatform.ai → 34.31.145.131 (proxied)
- Remove git.neuralplatform.ai route from Legion Cloudflare tunnel config
- Add Cloudflare config rule: flexible SSL for git.neuralplatform.ai
  (origin serves HTTP/3000, CF proxies HTTPS termination)
- Scale Legion Gitea deployment to 0 replicas (PVC preserved)
- git.neuralplatform.ai now serves from GKE Gitea pod

servers/legion/main.tf

@@ -108,16 +108,12 @@ resource "cloudflare_zero_trust_tunnel_cloudflared_config" "legion" {
       }
     }
 
-    # git.neuralplatform.ai — Gitea web UI (HTTP via Traefik)
-    ingress_rule {
-      hostname = "git.neuralplatform.ai"
-      service  = "https://traefik.kube-system.svc:443"
-      origin_request {
-        no_tls_verify = true
-      }
-    }
+    # git.neuralplatform.ai — REMOVED: Gitea is now on GKE.
+    # DNS is a direct Cloudflare A record (proxied) pointing at the GKE LoadBalancer IP.
+    # See: servers/legion/dns-neuralplatform.tf (cloudflare_record.np_gitea)
 
     # ssh.git.neuralplatform.ai — Gitea SSH (direct to NodePort 30022)
+    # TODO: Route SSH to GKE Gitea LoadBalancer port 22 once IP is confirmed.
     ingress_rule {
       hostname = "ssh.git.neuralplatform.ai"
       service  = "ssh://localhost:30022"