Migrate all app deployments from Terraform to Argo CD

Move gitea, github-runner, neuron, cloudflared, ollama, verdaccio,
devpi, registry, and registry-ui deployments+services to apps/*.yaml
so Argo CD manages the app layer. Terraform retains namespaces, PVCs,
ConfigMaps, Secrets, and Ingresses.

New Secrets in Terraform:
- kubernetes_secret.github_runner_secret (ci/github-runner-secret)
- kubernetes_secret.cloudflared_secret (neuron/cloudflared-secret)

Hardcoded service names in ingress.tf and neuron.tf to remove
dependency on removed kubernetes_service resources.

servers/legion/github-runner.tf

@@ -1,94 +1,12 @@
 # GitHub Actions Self-Hosted Runner — org-level, serves all repos
-resource "kubernetes_deployment" "github_runner" {
+# Deployment managed by Argo CD — see servers/legion/apps/github-runner.yaml
+
+resource "kubernetes_secret" "github_runner_secret" {
   metadata {
-    name      = "github-runner"
+    name      = "github-runner-secret"
     namespace = kubernetes_namespace.ci.metadata[0].name
-    labels = {
-      app = "github-runner"
-    }
   }
-
-  spec {
-    replicas = 1
-
-    selector {
-      match_labels = {
-        app = "github-runner"
-      }
-    }
-
-    template {
-      metadata {
-        labels = {
-          app = "github-runner"
-        }
-      }
-
-      spec {
-        container {
-          name  = "runner"
-          image = "myoung34/github-runner:latest"
-
-          env {
-            name  = "ACCESS_TOKEN"
-            value = var.github_classic_pat
-          }
-
-          env {
-            name  = "RUNNER_SCOPE"
-            value = "org"
-          }
-
-          env {
-            name  = "ORG_NAME"
-            value = "harmonic-framework"
-          }
-
-          env {
-            name  = "RUNNER_NAME"
-            value = "legion"
-          }
-
-          env {
-            name  = "RUNNER_WORKDIR"
-            value = "/tmp/runner"
-          }
-
-          env {
-            name  = "LABELS"
-            value = "self-hosted,linux,x64,legion"
-          }
-
-          env {
-            name  = "DISABLE_AUTO_UPDATE"
-            value = "true"
-          }
-
-          volume_mount {
-            name       = "docker-sock"
-            mount_path = "/var/run/docker.sock"
-          }
-
-          resources {
-            requests = {
-              memory = "512Mi"
-              cpu    = "250m"
-            }
-            limits = {
-              memory = "4Gi"
-              cpu    = "4"
-            }
-          }
-        }
-
-        volume {
-          name = "docker-sock"
-          host_path {
-            path = "/var/run/docker.sock"
-            type = "Socket"
-          }
-        }
-      }
-    }
+  data = {
+    ACCESS_TOKEN = var.github_classic_pat
   }
 }