Migrate all app deployments from Terraform to Argo CD

Move gitea, github-runner, neuron, cloudflared, ollama, verdaccio,
devpi, registry, and registry-ui deployments+services to apps/*.yaml
so Argo CD manages the app layer. Terraform retains namespaces, PVCs,
ConfigMaps, Secrets, and Ingresses.

New Secrets in Terraform:
- kubernetes_secret.github_runner_secret (ci/github-runner-secret)
- kubernetes_secret.cloudflared_secret (neuron/cloudflared-secret)

Hardcoded service names in ingress.tf and neuron.tf to remove
dependency on removed kubernetes_service resources.

servers/legion/apps/gitea.yaml

@@ -0,0 +1,102 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: gitea
+  namespace: git
+  labels:
+    app: gitea
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: gitea
+  template:
+    metadata:
+      labels:
+        app: gitea
+    spec:
+      containers:
+        - name: gitea
+          image: gitea/gitea:1.22
+          ports:
+            - name: http
+              containerPort: 3000
+            - name: ssh
+              containerPort: 22
+          env:
+            - name: GITEA__database__DB_TYPE
+              value: postgres
+            - name: GITEA__database__HOST
+              value: postgres-postgresql.platform.svc.cluster.local:5432
+            - name: GITEA__database__NAME
+              value: gitea
+            - name: GITEA__database__USER
+              value: gitea
+            - name: GITEA__database__PASSWD
+              valueFrom:
+                secretKeyRef:
+                  name: gitea-db
+                  key: password
+            - name: GITEA__server__DOMAIN
+              value: git.neuralplatform.dev
+            - name: GITEA__server__ROOT_URL
+              value: https://git.neuralplatform.dev
+            - name: GITEA__server__SSH_DOMAIN
+              value: git.neuralplatform.dev
+            - name: GITEA__server__SSH_PORT
+              value: "30022"
+            - name: GITEA__server__START_SSH_SERVER
+              value: "false"
+            - name: GITEA__service__DISABLE_REGISTRATION
+              value: "true"
+            - name: GITEA__service__REQUIRE_SIGNIN_VIEW
+              value: "true"
+            - name: GITEA__security__INSTALL_LOCK
+              value: "true"
+            - name: GITEA__packages__ENABLED
+              value: "true"
+            - name: GITEA__webhook__ALLOWED_HOST_LIST
+              value: 192.168.0.0/24,10.0.0.0/8
+          volumeMounts:
+            - name: data
+              mountPath: /data
+            - name: custom-css
+              mountPath: /data/gitea/custom/public/assets/css/custom.css
+              subPath: custom.css
+            - name: custom-css
+              mountPath: /data/gitea/custom/templates/custom/header.tmpl
+              subPath: header.tmpl
+          resources:
+            requests:
+              memory: 256Mi
+              cpu: 100m
+            limits:
+              memory: 512Mi
+              cpu: 500m
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: gitea-data
+        - name: custom-css
+          configMap:
+            name: gitea-custom-css
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: gitea
+  namespace: git
+spec:
+  selector:
+    app: gitea
+  ports:
+    - name: http
+      port: 3000
+      targetPort: 3000
+    - name: ssh
+      port: 22
+      targetPort: 22
+      nodePort: 30022
+  type: NodePort