infra: add neurontechnologies.ai Cloudflare routing and k8s namespaces

- Add CNAME records for @, www, dev, stage → legion tunnel
- Add tunnel ingress rules for neurontechnologies.ai, www, dev, stage
- Add neuron-dev, neuron-stage, neuron-prod k8s namespaces on Legion

servers/legion/dns-neurontechnologies.tf

@@ -2,6 +2,47 @@
 # Google Workspace MX, SPF, and DMARC records.
 # After signing up for Google Workspace, add your verification TXT record below.
 
+# ── Cloudflare tunnel CNAMEs ─────────────────────────────────────────────────
+# All three environments route through the legion tunnel to Traefik.
+# proxied = true enables Cloudflare proxy (CDN, DDoS, SSL termination).
+# ttl = 1 means "auto" when proxied.
+
+resource "cloudflare_record" "nt_tunnel_prod" {
+  zone_id = local.zone_neurontechnologies_ai
+  name    = "@"
+  type    = "CNAME"
+  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
+  proxied = true
+  ttl     = 1
+}
+
+resource "cloudflare_record" "nt_tunnel_www" {
+  zone_id = local.zone_neurontechnologies_ai
+  name    = "www"
+  type    = "CNAME"
+  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
+  proxied = true
+  ttl     = 1
+}
+
+resource "cloudflare_record" "nt_tunnel_dev" {
+  zone_id = local.zone_neurontechnologies_ai
+  name    = "dev"
+  type    = "CNAME"
+  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
+  proxied = true
+  ttl     = 1
+}
+
+resource "cloudflare_record" "nt_tunnel_stage" {
+  zone_id = local.zone_neurontechnologies_ai
+  name    = "stage"
+  type    = "CNAME"
+  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
+  proxied = true
+  ttl     = 1
+}
+
 # ── Google Workspace MX records ──────────────────────────────────────────────
 resource "cloudflare_record" "nt_mx_1" {
   zone_id  = local.zone_neurontechnologies_ai