migrate Vault and Gitea to GKE Autopilot cluster

Implements Option A: move Vault (3x GCE e2-small) and Gitea (Legion k8s)
onto a new GKE Autopilot cluster (neuron-platform, us-central1) managed
through Legion Argo CD.

Terraform (servers/gcp/):
- gke.tf: GKE Autopilot cluster, Workload Identity bindings for Vault (KMS)
  and Gitea (Cloud SQL)
- cloud-sql.tf: gitea database + user on neuron-prod-pg15, gitea GCP SA,
  gitea-database-url and gitea-db-password Secret Manager secrets
- vault-nodes.tf: PENDING DECOMMISSION comment with migration checklist

k8s manifests (servers/gcp/k8s/):
- vault/: namespace.yaml
- gitea/: namespace, serviceaccount (Workload Identity annotation), pvc (50Gi
  standard-rwo), deployment (Gitea + Cloud SQL Auth Proxy sidecar), service,
  configmap (custom CSS carried from Legion), external-secrets (GCP SM provider)
- argocd-apps/: vault-gke.yaml, vault-helm-gke.yaml (Helm chart, HA Raft 3
  replicas, GCP KMS auto-unseal, topologySpread across zones, 10Gi premium-rwo),
  gitea-gke.yaml — all target GKE_CLUSTER_ENDPOINT placeholder

Legion (servers/legion/):
- apps/gke-apps.yaml: App-of-Apps entry point on Legion Argo CD that syncs the
  GKE Application manifests
- k8s/gitea-runner/Dockerfile: add system-level git insteadOf so GKE CI runners
  resolve Gitea in-cluster without Cloudflare Access headers

servers/gcp/k8s/argocd-apps/vault-gke.yaml

@@ -0,0 +1,33 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: vault-gke
+  namespace: argocd
+  annotations:
+    # Syncs plain k8s manifests for Vault to the GKE cluster.
+    # The Vault Helm release itself is in vault-helm-gke.yaml.
+    #
+    # Apply to Legion Argo CD after registering the GKE cluster:
+    #   1. gcloud container clusters get-credentials neuron-platform \
+    #        --region us-central1 --project neuron-785695
+    #   2. argocd cluster add <context-name> --name gke-neuron-platform
+    #   3. Update GKE_CLUSTER_ENDPOINT in all argocd-apps/*.yaml:
+    #        terraform -chdir=servers/gcp output -raw gke_cluster_endpoint
+spec:
+  project: default
+  source:
+    repoURL: http://gitea.git.svc.cluster.local:3000/will/infrastructure.git
+    targetRevision: main
+    path: servers/gcp/k8s/vault
+  destination:
+    # Replace GKE_CLUSTER_ENDPOINT after `terraform apply`:
+    #   terraform -chdir=servers/gcp output -raw gke_cluster_endpoint
+    server: https://GKE_CLUSTER_ENDPOINT
+    namespace: vault
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true