migrate Vault and Gitea to GKE Autopilot cluster

Implements Option A: move Vault (3x GCE e2-small) and Gitea (Legion k8s)
onto a new GKE Autopilot cluster (neuron-platform, us-central1) managed
through Legion Argo CD.

Terraform (servers/gcp/):
- gke.tf: GKE Autopilot cluster, Workload Identity bindings for Vault (KMS)
  and Gitea (Cloud SQL)
- cloud-sql.tf: gitea database + user on neuron-prod-pg15, gitea GCP SA,
  gitea-database-url and gitea-db-password Secret Manager secrets
- vault-nodes.tf: PENDING DECOMMISSION comment with migration checklist

k8s manifests (servers/gcp/k8s/):
- vault/: namespace.yaml
- gitea/: namespace, serviceaccount (Workload Identity annotation), pvc (50Gi
  standard-rwo), deployment (Gitea + Cloud SQL Auth Proxy sidecar), service,
  configmap (custom CSS carried from Legion), external-secrets (GCP SM provider)
- argocd-apps/: vault-gke.yaml, vault-helm-gke.yaml (Helm chart, HA Raft 3
  replicas, GCP KMS auto-unseal, topologySpread across zones, 10Gi premium-rwo),
  gitea-gke.yaml — all target GKE_CLUSTER_ENDPOINT placeholder

Legion (servers/legion/):
- apps/gke-apps.yaml: App-of-Apps entry point on Legion Argo CD that syncs the
  GKE Application manifests
- k8s/gitea-runner/Dockerfile: add system-level git insteadOf so GKE CI runners
  resolve Gitea in-cluster without Cloudflare Access headers

servers/gcp/k8s/gitea/configmap.yaml

@@ -0,0 +1,104 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: gitea-custom-css
+  namespace: gitea
+data:
+  header.tmpl: |
+    <link rel="stylesheet" href="/assets/css/custom.css">
+  custom.css: |
+    /* ── Typography & base ── */
+    :root {
+      --color-primary: #6366f1;
+      --color-primary-dark: #4f46e5;
+      --color-secondary: #8b5cf6;
+      --color-bg: #0f0f17;
+      --color-surface: #16161f;
+      --color-surface-2: #1e1e2e;
+      --color-border: #2a2a3d;
+      --color-text: #e2e2f0;
+      --color-text-muted: #8888aa;
+      --color-green: #22d3a5;
+      --radius: 10px;
+    }
+
+    body {
+      background: var(--color-bg) !important;
+      color: var(--color-text) !important;
+      font-family: "Inter", -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif !important;
+    }
+
+    /* ── Top navbar ── */
+    .navbar, #navbar {
+      background: var(--color-surface) !important;
+      border-bottom: 1px solid var(--color-border) !important;
+      box-shadow: 0 1px 12px rgba(0,0,0,0.4) !important;
+    }
+
+    .navbar .brand svg, .navbar .brand img { filter: brightness(1.2); }
+
+    /* ── Sidebar & panels ── */
+    .repository, .ui.container, .ui.segment,
+    .ui.card, .ui.cards > .card {
+      background: var(--color-surface) !important;
+      border: 1px solid var(--color-border) !important;
+      border-radius: var(--radius) !important;
+    }
+
+    /* ── Buttons ── */
+    .ui.primary.button, .ui.green.button {
+      background: var(--color-primary) !important;
+      border: none !important;
+      border-radius: 8px !important;
+    }
+    .ui.primary.button:hover { background: var(--color-primary-dark) !important; }
+
+    /* ── Inputs ── */
+    input, textarea, select,
+    .ui.input > input, .ui.dropdown {
+      background: var(--color-surface-2) !important;
+      border: 1px solid var(--color-border) !important;
+      color: var(--color-text) !important;
+      border-radius: 8px !important;
+    }
+
+    /* ── Sign-in page ── */
+    .user.signin .ui.segment,
+    .user.signup .ui.segment {
+      background: var(--color-surface) !important;
+      border: 1px solid var(--color-border) !important;
+      border-radius: 16px !important;
+      box-shadow: 0 8px 32px rgba(0,0,0,0.5) !important;
+      padding: 2.5rem !important;
+    }
+
+    /* ── Repo file tree ── */
+    .repository.file.list .file-list {
+      background: var(--color-surface) !important;
+      border-radius: var(--radius) !important;
+      border: 1px solid var(--color-border) !important;
+    }
+
+    .repository.file.list .file-list tr:hover td {
+      background: var(--color-surface-2) !important;
+    }
+
+    /* ── Labels & badges ── */
+    .ui.label { border-radius: 6px !important; }
+
+    /* ── Dashboard activity feed ── */
+    .feeds .news { border-bottom: 1px solid var(--color-border) !important; }
+
+    /* ── Code blocks ── */
+    pre, code {
+      background: var(--color-surface-2) !important;
+      border: 1px solid var(--color-border) !important;
+      border-radius: 6px !important;
+    }
+
+    /* ── Muted footer ── */
+    #footer {
+      background: var(--color-surface) !important;
+      border-top: 1px solid var(--color-border) !important;
+      color: var(--color-text-muted) !important;
+    }