Migrate all app deployments from Terraform to Argo CD

Move gitea, github-runner, neuron, cloudflared, ollama, verdaccio,
devpi, registry, and registry-ui deployments+services to apps/*.yaml
so Argo CD manages the app layer. Terraform retains namespaces, PVCs,
ConfigMaps, Secrets, and Ingresses.

New Secrets in Terraform:
- kubernetes_secret.github_runner_secret (ci/github-runner-secret)
- kubernetes_secret.cloudflared_secret (neuron/cloudflared-secret)

Hardcoded service names in ingress.tf and neuron.tf to remove
dependency on removed kubernetes_service resources.

servers/legion/packages.tf

@@ -75,156 +75,4 @@ resource "kubernetes_config_map" "verdaccio_config" {
   }
 }
 
-resource "kubernetes_deployment" "verdaccio" {
-  metadata {
-    name      = "verdaccio"
-    namespace = kubernetes_namespace.packages.metadata[0].name
-  }
-
-  spec {
-    replicas = 1
-    selector {
-      match_labels = { app = "verdaccio" }
-    }
-    template {
-      metadata {
-        labels = { app = "verdaccio" }
-      }
-      spec {
-        security_context {
-          fs_group = 101
-        }
-        container {
-          name  = "verdaccio"
-          image = "verdaccio/verdaccio:5"
-
-          port {
-            container_port = 4873
-          }
-
-          # Override k8s service env injection which conflicts with Verdaccio's port detection
-          env {
-            name  = "VERDACCIO_PORT"
-            value = "4873"
-          }
-
-          volume_mount {
-            name       = "config"
-            mount_path = "/verdaccio/conf/config.yaml"
-            sub_path   = "config.yaml"
-          }
-
-          volume_mount {
-            name       = "data"
-            mount_path = "/verdaccio/storage"
-          }
-
-          resources {
-            requests = { memory = "128Mi", cpu = "50m" }
-            limits   = { memory = "512Mi" }
-          }
-        }
-
-        volume {
-          name = "config"
-          config_map {
-            name = kubernetes_config_map.verdaccio_config.metadata[0].name
-          }
-        }
-
-        volume {
-          name = "data"
-          persistent_volume_claim {
-            claim_name = kubernetes_persistent_volume_claim.verdaccio_data.metadata[0].name
-          }
-        }
-      }
-    }
-  }
-}
-
-resource "kubernetes_service" "verdaccio" {
-  metadata {
-    name      = "verdaccio"
-    namespace = kubernetes_namespace.packages.metadata[0].name
-  }
-  spec {
-    selector = { app = "verdaccio" }
-    port {
-      port        = 4873
-      target_port = 4873
-    }
-  }
-}
-
-# devpi — PyPI proxy/cache
-resource "kubernetes_deployment" "devpi" {
-  metadata {
-    name      = "devpi"
-    namespace = kubernetes_namespace.packages.metadata[0].name
-  }
-
-  spec {
-    replicas = 1
-    selector {
-      match_labels = { app = "devpi" }
-    }
-    template {
-      metadata {
-        labels = { app = "devpi" }
-      }
-      spec {
-        init_container {
-          name  = "devpi-init"
-          image = "python:3.12-slim"
-          command = ["sh", "-c", "pip install -q devpi-server devpi-web && if [ ! -f /data/.serverversion ]; then devpi-init --serverdir /data; fi && chmod 600 /data/.secret 2>/dev/null || true"]
-          volume_mount {
-            name       = "data"
-            mount_path = "/data"
-          }
-        }
-
-        container {
-          name  = "devpi"
-          image = "python:3.12-slim"
-          command = ["sh", "-c", "pip install -q devpi-server devpi-web && exec devpi-server --serverdir /data --host 0.0.0.0 --port 3141 --outside-url https://pypi.neuralplatform.ai"]
-
-          port {
-            container_port = 3141
-          }
-
-          volume_mount {
-            name       = "data"
-            mount_path = "/data"
-          }
-
-          resources {
-            requests = { memory = "512Mi", cpu = "100m" }
-            limits   = { memory = "2Gi" }
-          }
-        }
-
-        volume {
-          name = "data"
-          persistent_volume_claim {
-            claim_name = kubernetes_persistent_volume_claim.devpi_data.metadata[0].name
-          }
-        }
-      }
-    }
-  }
-}
-
-resource "kubernetes_service" "devpi" {
-  metadata {
-    name      = "devpi"
-    namespace = kubernetes_namespace.packages.metadata[0].name
-  }
-  spec {
-    selector = { app = "devpi" }
-    port {
-      port        = 3141
-      target_port = 3141
-    }
-  }
-}
+# Deployments + Services managed by Argo CD — see servers/legion/apps/packages.yaml