infra: add neurontechnologies.ai Cloudflare routing and k8s namespaces

- Add CNAME records for @, www, dev, stage → legion tunnel
- Add tunnel ingress rules for neurontechnologies.ai, www, dev, stage
- Add neuron-dev, neuron-stage, neuron-prod k8s namespaces on Legion

servers/legion/dns-neurontechnologies.tf

@@ -2,6 +2,47 @@
 # Google Workspace MX, SPF, and DMARC records.
 # After signing up for Google Workspace, add your verification TXT record below.
 
+# ── Cloudflare tunnel CNAMEs ─────────────────────────────────────────────────
+# All three environments route through the legion tunnel to Traefik.
+# proxied = true enables Cloudflare proxy (CDN, DDoS, SSL termination).
+# ttl = 1 means "auto" when proxied.
+
+resource "cloudflare_record" "nt_tunnel_prod" {
+  zone_id = local.zone_neurontechnologies_ai
+  name    = "@"
+  type    = "CNAME"
+  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
+  proxied = true
+  ttl     = 1
+}
+
+resource "cloudflare_record" "nt_tunnel_www" {
+  zone_id = local.zone_neurontechnologies_ai
+  name    = "www"
+  type    = "CNAME"
+  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
+  proxied = true
+  ttl     = 1
+}
+
+resource "cloudflare_record" "nt_tunnel_dev" {
+  zone_id = local.zone_neurontechnologies_ai
+  name    = "dev"
+  type    = "CNAME"
+  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
+  proxied = true
+  ttl     = 1
+}
+
+resource "cloudflare_record" "nt_tunnel_stage" {
+  zone_id = local.zone_neurontechnologies_ai
+  name    = "stage"
+  type    = "CNAME"
+  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
+  proxied = true
+  ttl     = 1
+}
+
 # ── Google Workspace MX records ──────────────────────────────────────────────
 resource "cloudflare_record" "nt_mx_1" {
   zone_id  = local.zone_neurontechnologies_ai

servers/legion/main.tf

@@ -118,6 +118,41 @@ resource "cloudflare_zero_trust_tunnel_cloudflared_config" "legion" {
       service  = "ssh://localhost:30022"
     }
 
+    # neurontechnologies.ai — Neuron Technologies prod (neuron-prod namespace)
+    ingress_rule {
+      hostname = "neurontechnologies.ai"
+      service  = "https://traefik.kube-system.svc:443"
+      origin_request {
+        no_tls_verify = true
+      }
+    }
+
+    ingress_rule {
+      hostname = "www.neurontechnologies.ai"
+      service  = "https://traefik.kube-system.svc:443"
+      origin_request {
+        no_tls_verify = true
+      }
+    }
+
+    # dev.neurontechnologies.ai — Neuron Technologies dev (neuron-dev namespace)
+    ingress_rule {
+      hostname = "dev.neurontechnologies.ai"
+      service  = "https://traefik.kube-system.svc:443"
+      origin_request {
+        no_tls_verify = true
+      }
+    }
+
+    # stage.neurontechnologies.ai — Neuron Technologies stage (neuron-stage namespace)
+    ingress_rule {
+      hostname = "stage.neurontechnologies.ai"
+      service  = "https://traefik.kube-system.svc:443"
+      origin_request {
+        no_tls_verify = true
+      }
+    }
+
     # Catch-all — must be last
     ingress_rule {
       service = "http_status:404"

servers/legion/neuron-technologies.tf

@@ -0,0 +1,39 @@
+# Neuron Technologies — dev / stage / prod namespaces
+# All other resources (Deployments, Services, IngressRoutes, ExternalSecrets, PVCs)
+# are managed by Argo CD from k8s/neuron-technologies/{env}/
+
+resource "kubernetes_namespace" "neuron_dev" {
+  metadata {
+    name = "neuron-dev"
+    labels = {
+      managed-by  = "terraform"
+      tier        = "apps"
+      environment = "dev"
+      app         = "neuron-technologies"
+    }
+  }
+}
+
+resource "kubernetes_namespace" "neuron_stage" {
+  metadata {
+    name = "neuron-stage"
+    labels = {
+      managed-by  = "terraform"
+      tier        = "apps"
+      environment = "stage"
+      app         = "neuron-technologies"
+    }
+  }
+}
+
+resource "kubernetes_namespace" "neuron_prod" {
+  metadata {
+    name = "neuron-prod"
+    labels = {
+      managed-by  = "terraform"
+      tier        = "apps"
+      environment = "prod"
+      app         = "neuron-technologies"
+    }
+  }
+}