feat(api): expose api.neurontechnologies.ai + add Stripe and R2 secrets

- Add api.neurontechnologies.ai DNS CNAME → CF tunnel
- Add tunnel ingress rule for api.neurontechnologies.ai → Traefik
- Create rest-ingressroute.yaml: api.neurontechnologies.ai → neuron-rest:8081
- Add STRIPE_SECRET_KEY to neuron-prod ExternalSecret (from marketing-test Vault)

servers/legion/k8s/neuron-technologies/prod/externalsecret.yaml

@@ -48,3 +48,7 @@ spec:
       remoteRef:
         key: secret/data/r2
         property: neuron_bucket
+    - secretKey: STRIPE_SECRET_KEY
+      remoteRef:
+        key: secret/data/neuron-technologies/marketing-test
+        property: stripe_secret_key

servers/legion/k8s/neuron-technologies/prod/kustomization.yaml

@@ -11,6 +11,7 @@ resources:
   - services.yaml
   - ingress.yaml
   - license-ingressroute.yaml
+  - rest-ingressroute.yaml
   - backup-cronjob.yaml
   - runpod-inference.yaml
   - runpod-lb-configmap.yaml

servers/legion/k8s/neuron-technologies/prod/rest-ingressroute.yaml

@@ -0,0 +1,18 @@
+# Traefik IngressRoute: api.neurontechnologies.ai → neuron-rest service
+# Exposes the Neuron backend REST API externally for CLI and web clients.
+# CLI config: api_url = https://api.neurontechnologies.ai
+
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: neuron-rest-api
+  namespace: neuron-prod
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`api.neurontechnologies.ai`)
+      kind: Rule
+      services:
+        - name: neuron-rest
+          port: 8081