infra: add neurontechnologies.ai Cloudflare routing and k8s namespaces

- Add CNAME records for @, www, dev, stage → legion tunnel
- Add tunnel ingress rules for neurontechnologies.ai, www, dev, stage
- Add neuron-dev, neuron-stage, neuron-prod k8s namespaces on Legion

servers/legion/main.tf

@@ -118,6 +118,41 @@ resource "cloudflare_zero_trust_tunnel_cloudflared_config" "legion" {
       service  = "ssh://localhost:30022"
     }
 
+    # neurontechnologies.ai — Neuron Technologies prod (neuron-prod namespace)
+    ingress_rule {
+      hostname = "neurontechnologies.ai"
+      service  = "https://traefik.kube-system.svc:443"
+      origin_request {
+        no_tls_verify = true
+      }
+    }
+
+    ingress_rule {
+      hostname = "www.neurontechnologies.ai"
+      service  = "https://traefik.kube-system.svc:443"
+      origin_request {
+        no_tls_verify = true
+      }
+    }
+
+    # dev.neurontechnologies.ai — Neuron Technologies dev (neuron-dev namespace)
+    ingress_rule {
+      hostname = "dev.neurontechnologies.ai"
+      service  = "https://traefik.kube-system.svc:443"
+      origin_request {
+        no_tls_verify = true
+      }
+    }
+
+    # stage.neurontechnologies.ai — Neuron Technologies stage (neuron-stage namespace)
+    ingress_rule {
+      hostname = "stage.neurontechnologies.ai"
+      service  = "https://traefik.kube-system.svc:443"
+      origin_request {
+        no_tls_verify = true
+      }
+    }
+
     # Catch-all — must be last
     ingress_rule {
       service = "http_status:404"