migrate Vault and Gitea to GKE Autopilot cluster

Implements Option A: move Vault (3x GCE e2-small) and Gitea (Legion k8s)
onto a new GKE Autopilot cluster (neuron-platform, us-central1) managed
through Legion Argo CD.

Terraform (servers/gcp/):
- gke.tf: GKE Autopilot cluster, Workload Identity bindings for Vault (KMS)
  and Gitea (Cloud SQL)
- cloud-sql.tf: gitea database + user on neuron-prod-pg15, gitea GCP SA,
  gitea-database-url and gitea-db-password Secret Manager secrets
- vault-nodes.tf: PENDING DECOMMISSION comment with migration checklist

k8s manifests (servers/gcp/k8s/):
- vault/: namespace.yaml
- gitea/: namespace, serviceaccount (Workload Identity annotation), pvc (50Gi
  standard-rwo), deployment (Gitea + Cloud SQL Auth Proxy sidecar), service,
  configmap (custom CSS carried from Legion), external-secrets (GCP SM provider)
- argocd-apps/: vault-gke.yaml, vault-helm-gke.yaml (Helm chart, HA Raft 3
  replicas, GCP KMS auto-unseal, topologySpread across zones, 10Gi premium-rwo),
  gitea-gke.yaml — all target GKE_CLUSTER_ENDPOINT placeholder

Legion (servers/legion/):
- apps/gke-apps.yaml: App-of-Apps entry point on Legion Argo CD that syncs the
  GKE Application manifests
- k8s/gitea-runner/Dockerfile: add system-level git insteadOf so GKE CI runners
  resolve Gitea in-cluster without Cloudflare Access headers

servers/gcp/vault-nodes.tf

@@ -1,3 +1,12 @@
+# PENDING DECOMMISSION — migrating to GKE Autopilot (gke.tf). Remove after Vault data migrated.
+# Migration checklist:
+#   1. Bring up Vault StatefulSet on GKE (servers/gcp/k8s/vault/)
+#   2. Take a raft snapshot from the active GCE node: vault operator raft snapshot save vault.snap
+#   3. Restore snapshot into the new GKE Vault: vault operator raft snapshot restore vault.snap
+#   4. Validate all secrets are accessible from the GKE cluster
+#   5. Update Cloudflare DNS / LB to point vault.neuralplatform.ai at GKE ingress
+#   6. Remove this file and the vault-kms.tf GCE-specific IAM (keep the KMS key + SA)
+#
 # ── Vault HA Cluster — GCE-based Raft ────────────────────────────────────────
 #
 # Three GCE e2-small VMs across us-central1-{a,b,c} running HashiCorp Vault