feat(api): expose api.neurontechnologies.ai + add Stripe and R2 secrets

- Add api.neurontechnologies.ai DNS CNAME → CF tunnel
- Add tunnel ingress rule for api.neurontechnologies.ai → Traefik
- Create rest-ingressroute.yaml: api.neurontechnologies.ai → neuron-rest:8081
- Add STRIPE_SECRET_KEY to neuron-prod ExternalSecret (from marketing-test Vault)

servers/legion/dns-neurontechnologies.tf

@@ -7,6 +7,15 @@
 # proxied = true enables Cloudflare proxy (CDN, DDoS, SSL termination).
 # ttl = 1 means "auto" when proxied.
 
+resource "cloudflare_record" "nt_tunnel_api" {
+  zone_id = local.zone_neurontechnologies_ai
+  name    = "api"
+  type    = "CNAME"
+  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
+  proxied = true
+  ttl     = 1
+}
+
 resource "cloudflare_record" "nt_tunnel_prod" {
   zone_id = local.zone_neurontechnologies_ai
   name    = "@"