Migrate all app deployments from Terraform to Argo CD

Move gitea, github-runner, neuron, cloudflared, ollama, verdaccio,
devpi, registry, and registry-ui deployments+services to apps/*.yaml
so Argo CD manages the app layer. Terraform retains namespaces, PVCs,
ConfigMaps, Secrets, and Ingresses.

New Secrets in Terraform:
- kubernetes_secret.github_runner_secret (ci/github-runner-secret)
- kubernetes_secret.cloudflared_secret (neuron/cloudflared-secret)

Hardcoded service names in ingress.tf and neuron.tf to remove
dependency on removed kubernetes_service resources.

servers/legion/ingress.tf

@@ -24,7 +24,7 @@ resource "kubernetes_ingress_v1" "ollama" {
           path_type = "Prefix"
           backend {
             service {
-              name = kubernetes_service.ollama.metadata[0].name
+              name = "ollama"
               port { number = 11434 }
             }
           }
@@ -60,7 +60,7 @@ resource "kubernetes_ingress_v1" "registry" {
           path_type = "Prefix"
           backend {
             service {
-              name = kubernetes_service.registry.metadata[0].name
+              name = "registry"
               port { number = 5000 }
             }
           }
@@ -95,7 +95,7 @@ resource "kubernetes_ingress_v1" "registry_ui" {
           path_type = "Prefix"
           backend {
             service {
-              name = kubernetes_service.registry_ui.metadata[0].name
+              name = "registry-ui"
               port { number = 80 }
             }
           }
@@ -131,7 +131,7 @@ resource "kubernetes_ingress_v1" "npm_registry" {
           path_type = "Prefix"
           backend {
             service {
-              name = kubernetes_service.verdaccio.metadata[0].name
+              name = "verdaccio"
               port { number = 4873 }
             }
           }
@@ -140,7 +140,7 @@ resource "kubernetes_ingress_v1" "npm_registry" {
     }
   }
 
-  depends_on = [helm_release.cert_manager, kubernetes_deployment.verdaccio]
+  depends_on = [helm_release.cert_manager]
 }
 
 # PyPI registry — devpi (proxies pypi.org, caches locally)
@@ -167,7 +167,7 @@ resource "kubernetes_ingress_v1" "pypi_registry" {
           path_type = "Prefix"
           backend {
             service {
-              name = kubernetes_service.devpi.metadata[0].name
+              name = "devpi"
               port { number = 3141 }
             }
           }
@@ -176,5 +176,5 @@ resource "kubernetes_ingress_v1" "pypi_registry" {
     }
   }
 
-  depends_on = [helm_release.cert_manager, kubernetes_deployment.devpi]
+  depends_on = [helm_release.cert_manager]
 }