feat(api): expose api.neurontechnologies.ai + add Stripe and R2 secrets

- Add api.neurontechnologies.ai DNS CNAME → CF tunnel
- Add tunnel ingress rule for api.neurontechnologies.ai → Traefik
- Create rest-ingressroute.yaml: api.neurontechnologies.ai → neuron-rest:8081
- Add STRIPE_SECRET_KEY to neuron-prod ExternalSecret (from marketing-test Vault)

servers/legion/dns-neurontechnologies.tf

@@ -7,6 +7,15 @@
 # proxied = true enables Cloudflare proxy (CDN, DDoS, SSL termination).
 # ttl = 1 means "auto" when proxied.
 
+resource "cloudflare_record" "nt_tunnel_api" {
+  zone_id = local.zone_neurontechnologies_ai
+  name    = "api"
+  type    = "CNAME"
+  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
+  proxied = true
+  ttl     = 1
+}
+
 resource "cloudflare_record" "nt_tunnel_prod" {
   zone_id = local.zone_neurontechnologies_ai
   name    = "@"

servers/legion/k8s/neuron-technologies/prod/externalsecret.yaml

@@ -48,3 +48,7 @@ spec:
       remoteRef:
         key: secret/data/r2
         property: neuron_bucket
+    - secretKey: STRIPE_SECRET_KEY
+      remoteRef:
+        key: secret/data/neuron-technologies/marketing-test
+        property: stripe_secret_key

servers/legion/k8s/neuron-technologies/prod/kustomization.yaml

@@ -11,6 +11,7 @@ resources:
   - services.yaml
   - ingress.yaml
   - license-ingressroute.yaml
+  - rest-ingressroute.yaml
   - backup-cronjob.yaml
   - runpod-inference.yaml
   - runpod-lb-configmap.yaml

servers/legion/k8s/neuron-technologies/prod/rest-ingressroute.yaml

@@ -0,0 +1,18 @@
+# Traefik IngressRoute: api.neurontechnologies.ai → neuron-rest service
+# Exposes the Neuron backend REST API externally for CLI and web clients.
+# CLI config: api_url = https://api.neurontechnologies.ai
+
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: neuron-rest-api
+  namespace: neuron-prod
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`api.neurontechnologies.ai`)
+      kind: Rule
+      services:
+        - name: neuron-rest
+          port: 8081

servers/legion/main.tf

@@ -207,6 +207,15 @@ resource "cloudflare_zero_trust_tunnel_cloudflared_config" "legion" {
       }
     }
 
+    # api.neurontechnologies.ai — Neuron REST backend (neuron-rest service)
+    ingress_rule {
+      hostname = "api.neurontechnologies.ai"
+      service  = "https://traefik.kube-system.svc:443"
+      origin_request {
+        no_tls_verify = true
+      }
+    }
+
     # sign.neurontechnologies.ai — Docuseal e-signature
     ingress_rule {
       hostname = "sign.neurontechnologies.ai"