Migrate all app deployments from Terraform to Argo CD

Move gitea, github-runner, neuron, cloudflared, ollama, verdaccio,
devpi, registry, and registry-ui deployments+services to apps/*.yaml
so Argo CD manages the app layer. Terraform retains namespaces, PVCs,
ConfigMaps, Secrets, and Ingresses.

New Secrets in Terraform:
- kubernetes_secret.github_runner_secret (ci/github-runner-secret)
- kubernetes_secret.cloudflared_secret (neuron/cloudflared-secret)

Hardcoded service names in ingress.tf and neuron.tf to remove
dependency on removed kubernetes_service resources.

servers/legion/apps/packages.yaml

@@ -0,0 +1,118 @@
+# Verdaccio — npm proxy/cache
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: verdaccio
+  namespace: packages
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: verdaccio
+  template:
+    metadata:
+      labels:
+        app: verdaccio
+    spec:
+      securityContext:
+        fsGroup: 101
+      containers:
+        - name: verdaccio
+          image: verdaccio/verdaccio:5
+          ports:
+            - containerPort: 4873
+          env:
+            - name: VERDACCIO_PORT
+              value: "4873"
+          volumeMounts:
+            - name: config
+              mountPath: /verdaccio/conf/config.yaml
+              subPath: config.yaml
+            - name: data
+              mountPath: /verdaccio/storage
+          resources:
+            requests:
+              memory: 128Mi
+              cpu: 50m
+            limits:
+              memory: 512Mi
+      volumes:
+        - name: config
+          configMap:
+            name: verdaccio-config
+        - name: data
+          persistentVolumeClaim:
+            claimName: verdaccio-data
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: verdaccio
+  namespace: packages
+spec:
+  selector:
+    app: verdaccio
+  ports:
+    - port: 4873
+      targetPort: 4873
+---
+# devpi — PyPI proxy/cache
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: devpi
+  namespace: packages
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: devpi
+  template:
+    metadata:
+      labels:
+        app: devpi
+    spec:
+      initContainers:
+        - name: devpi-init
+          image: python:3.12-slim
+          command:
+            - sh
+            - -c
+            - pip install -q devpi-server devpi-web && if [ ! -f /data/.serverversion ]; then devpi-init --serverdir /data; fi && chmod 600 /data/.secret 2>/dev/null || true
+          volumeMounts:
+            - name: data
+              mountPath: /data
+      containers:
+        - name: devpi
+          image: python:3.12-slim
+          command:
+            - sh
+            - -c
+            - pip install -q devpi-server devpi-web && exec devpi-server --serverdir /data --host 0.0.0.0 --port 3141 --outside-url https://pypi.neuralplatform.ai
+          ports:
+            - containerPort: 3141
+          volumeMounts:
+            - name: data
+              mountPath: /data
+          resources:
+            requests:
+              memory: 512Mi
+              cpu: 100m
+            limits:
+              memory: 2Gi
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: devpi-data
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: devpi
+  namespace: packages
+spec:
+  selector:
+    app: devpi
+  ports:
+    - port: 3141
+      targetPort: 3141