migrate Vault and Gitea to GKE Autopilot cluster

Implements Option A: move Vault (3x GCE e2-small) and Gitea (Legion k8s)
onto a new GKE Autopilot cluster (neuron-platform, us-central1) managed
through Legion Argo CD.

Terraform (servers/gcp/):
- gke.tf: GKE Autopilot cluster, Workload Identity bindings for Vault (KMS)
  and Gitea (Cloud SQL)
- cloud-sql.tf: gitea database + user on neuron-prod-pg15, gitea GCP SA,
  gitea-database-url and gitea-db-password Secret Manager secrets
- vault-nodes.tf: PENDING DECOMMISSION comment with migration checklist

k8s manifests (servers/gcp/k8s/):
- vault/: namespace.yaml
- gitea/: namespace, serviceaccount (Workload Identity annotation), pvc (50Gi
  standard-rwo), deployment (Gitea + Cloud SQL Auth Proxy sidecar), service,
  configmap (custom CSS carried from Legion), external-secrets (GCP SM provider)
- argocd-apps/: vault-gke.yaml, vault-helm-gke.yaml (Helm chart, HA Raft 3
  replicas, GCP KMS auto-unseal, topologySpread across zones, 10Gi premium-rwo),
  gitea-gke.yaml — all target GKE_CLUSTER_ENDPOINT placeholder

Legion (servers/legion/):
- apps/gke-apps.yaml: App-of-Apps entry point on Legion Argo CD that syncs the
  GKE Application manifests
- k8s/gitea-runner/Dockerfile: add system-level git insteadOf so GKE CI runners
  resolve Gitea in-cluster without Cloudflare Access headers

servers/legion/apps/gke-apps.yaml

@@ -0,0 +1,22 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: gke-apps
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: http://gitea.git.svc.cluster.local:3000/will/infrastructure.git
+    targetRevision: main
+    path: servers/gcp/k8s/argocd-apps
+  destination:
+    # This Application lives on Legion Argo CD — it creates child Applications
+    # there that target the GKE cluster.
+    server: https://kubernetes.default.svc
+    namespace: argocd
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

servers/legion/k8s/gitea-runner/Dockerfile

@@ -95,5 +95,18 @@ RUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
 # We deliberately don't set ENTRYPOINT / CMD here — act_runner spawns
 # build containers with its own entrypoint to keep them alive between
 # steps, and overriding it breaks job execution.
+
+# In-cluster git redirect — GKE runners resolve the internal Gitea service
+# directly, bypassing Cloudflare Access. This insteadOf rule rewrites any
+# clone/fetch of the public URL to the in-cluster service URL so CI jobs work
+# without CF Access headers inside the GKE cluster.
+#
+# On Legion runners this is overridden at runtime by git-cf-access-init.sh
+# (which sets the reverse redirect + CF Access headers). The system-level rule
+# here is a safe baseline; the init script wins because it runs after.
+RUN git config --system \
+    url."http://gitea.gitea.svc.cluster.local:3000/".insteadOf \
+    "https://git.neuralplatform.ai/"
+
 COPY git-cf-access-init.sh /usr/local/bin/git-cf-access-init.sh
 RUN chmod +x /usr/local/bin/git-cf-access-init.sh