Expand GCP infra: accounts + API services, Cloud SQL, Artifact Registry

Architecture: intelligence stays on Legion; only compiled artifacts cross
to GCP. Source code and Neuron's knowledge base never leave the system.

Artifact Registry:
- neuron-marketing, neuron-accounts, neuron-api repos in us-central1
- Keep-last-10 cleanup policy; ci-pusher SA with writer access
- Legion CI runners authenticate via GCP_SA_KEY Gitea secret

Cloud SQL (cloud-sql.tf):
- postgres-15 on db-g1-small, us-central1 (scale up to REGIONAL HA at 1k users)
- Point-in-time recovery, 14-day backup retention
- Accounts DB + user; password generated and stored in Secret Manager
- JWT signing key in Secret Manager (shared by accounts + api)
- Cloud Run connects via built-in Auth Proxy (Unix socket volume mount)

Accounts Cloud Run (cloud-run-accounts.tf):
- 3 regions (us-central1, europe-west1, asia-northeast1), min:1 max:50
- Cloud SQL proxy volume mount; secrets via Secret Manager
- Stripe + JWT env vars; health probe on /health

API Cloud Run (cloud-run-api.tf):
- 3 regions, min:1 max:100, cpu_idle=false (always-hot)
- Validates JWTs from accounts service; no direct DB connection
- License admin token from Secret Manager

Load balancer (host-based routing):
- Same global anycast IP for all three services
- URL map routes by Host: neurontechnologies.ai→marketing,
  api.neurontechnologies.ai→api, accounts.neurontechnologies.ai→accounts
- New managed SSL certs for api.* and accounts.* added to HTTPS proxy
- Cloud Armor (WAF + rate limit) applied to all backends

Service accounts + IAM:
- neuron-accounts-sa: secretmanager.secretAccessor + cloudsql.client
- neuron-api-sa: secretmanager.secretAccessor
- allUsers invoker on all prod Cloud Run services (LB health checks)

bootstrap.sh:
- One-shot setup: pulls Stripe secrets from Vault → Secret Manager,
  creates CI SA JSON key, prints DNS + next-step instructions

servers/gcp/load-balancer-backends.tf

@@ -0,0 +1,119 @@
+# ── Serverless NEGs — Accounts ────────────────────────────────────────────────
+
+resource "google_compute_region_network_endpoint_group" "accounts_us" {
+  name                  = "accounts-neg-us"
+  network_endpoint_type = "SERVERLESS"
+  region                = "us-central1"
+  project               = var.project_id
+  cloud_run { service = google_cloud_run_v2_service.accounts_us.name }
+}
+
+resource "google_compute_region_network_endpoint_group" "accounts_eu" {
+  name                  = "accounts-neg-eu"
+  network_endpoint_type = "SERVERLESS"
+  region                = "europe-west1"
+  project               = var.project_id
+  cloud_run { service = google_cloud_run_v2_service.accounts_eu.name }
+}
+
+resource "google_compute_region_network_endpoint_group" "accounts_apac" {
+  name                  = "accounts-neg-apac"
+  network_endpoint_type = "SERVERLESS"
+  region                = "asia-northeast1"
+  project               = var.project_id
+  cloud_run { service = google_cloud_run_v2_service.accounts_apac.name }
+}
+
+# ── Serverless NEGs — API ─────────────────────────────────────────────────────
+
+resource "google_compute_region_network_endpoint_group" "api_us" {
+  name                  = "api-neg-us"
+  network_endpoint_type = "SERVERLESS"
+  region                = "us-central1"
+  project               = var.project_id
+  cloud_run { service = google_cloud_run_v2_service.api_us.name }
+}
+
+resource "google_compute_region_network_endpoint_group" "api_eu" {
+  name                  = "api-neg-eu"
+  network_endpoint_type = "SERVERLESS"
+  region                = "europe-west1"
+  project               = var.project_id
+  cloud_run { service = google_cloud_run_v2_service.api_eu.name }
+}
+
+resource "google_compute_region_network_endpoint_group" "api_apac" {
+  name                  = "api-neg-apac"
+  network_endpoint_type = "SERVERLESS"
+  region                = "asia-northeast1"
+  project               = var.project_id
+  cloud_run { service = google_cloud_run_v2_service.api_apac.name }
+}
+
+# ── Backend Service — Accounts ────────────────────────────────────────────────
+
+resource "google_compute_backend_service" "accounts" {
+  name                  = "accounts-backend-prod"
+  project               = var.project_id
+  load_balancing_scheme = "EXTERNAL_MANAGED"
+  protocol              = "HTTPS"
+  timeout_sec           = 30
+
+  security_policy = google_compute_security_policy.marketing.self_link
+
+  # No CDN for accounts — responses are user-specific and must not be cached
+  enable_cdn = false
+
+  backend { group = google_compute_region_network_endpoint_group.accounts_us.self_link }
+  backend { group = google_compute_region_network_endpoint_group.accounts_eu.self_link }
+  backend { group = google_compute_region_network_endpoint_group.accounts_apac.self_link }
+
+  log_config {
+    enable      = true
+    sample_rate = 1.0
+  }
+}
+
+# ── Backend Service — API ─────────────────────────────────────────────────────
+
+resource "google_compute_backend_service" "api" {
+  name                  = "api-backend-prod"
+  project               = var.project_id
+  load_balancing_scheme = "EXTERNAL_MANAGED"
+  protocol              = "HTTPS"
+  timeout_sec           = 60  # API calls may be longer (AI inference routing)
+
+  security_policy = google_compute_security_policy.marketing.self_link
+
+  enable_cdn = false  # API responses are per-request; no CDN benefit
+
+  backend { group = google_compute_region_network_endpoint_group.api_us.self_link }
+  backend { group = google_compute_region_network_endpoint_group.api_eu.self_link }
+  backend { group = google_compute_region_network_endpoint_group.api_apac.self_link }
+
+  log_config {
+    enable      = true
+    sample_rate = 1.0
+  }
+}
+
+# ── SSL Certs — accounts and api subdomains ───────────────────────────────────
+# Added to the existing prod HTTPS proxy alongside the marketing cert.
+# DNS must point to the same prod global IP (marketing-ip-prod) for
+# provisioning to succeed.
+
+resource "google_compute_managed_ssl_certificate" "accounts" {
+  name    = "accounts-cert-prod"
+  project = var.project_id
+  managed {
+    domains = ["accounts.neurontechnologies.ai"]
+  }
+}
+
+resource "google_compute_managed_ssl_certificate" "api" {
+  name    = "api-cert-prod"
+  project = var.project_id
+  managed {
+    domains = ["api.neurontechnologies.ai"]
+  }
+}