feat(api): expose api.neurontechnologies.ai + add Stripe and R2 secrets

- Add api.neurontechnologies.ai DNS CNAME → CF tunnel
- Add tunnel ingress rule for api.neurontechnologies.ai → Traefik
- Create rest-ingressroute.yaml: api.neurontechnologies.ai → neuron-rest:8081
- Add STRIPE_SECRET_KEY to neuron-prod ExternalSecret (from marketing-test Vault)

servers/legion/main.tf

@@ -207,6 +207,15 @@ resource "cloudflare_zero_trust_tunnel_cloudflared_config" "legion" {
       }
     }
 
+    # api.neurontechnologies.ai — Neuron REST backend (neuron-rest service)
+    ingress_rule {
+      hostname = "api.neurontechnologies.ai"
+      service  = "https://traefik.kube-system.svc:443"
+      origin_request {
+        no_tls_verify = true
+      }
+    }
+
     # sign.neurontechnologies.ai — Docuseal e-signature
     ingress_rule {
       hostname = "sign.neurontechnologies.ai"