Expand GCP infra: accounts + API services, Cloud SQL, Artifact Registry

Architecture: intelligence stays on Legion; only compiled artifacts cross
to GCP. Source code and Neuron's knowledge base never leave the system.

Artifact Registry:
- neuron-marketing, neuron-accounts, neuron-api repos in us-central1
- Keep-last-10 cleanup policy; ci-pusher SA with writer access
- Legion CI runners authenticate via GCP_SA_KEY Gitea secret

Cloud SQL (cloud-sql.tf):
- postgres-15 on db-g1-small, us-central1 (scale up to REGIONAL HA at 1k users)
- Point-in-time recovery, 14-day backup retention
- Accounts DB + user; password generated and stored in Secret Manager
- JWT signing key in Secret Manager (shared by accounts + api)
- Cloud Run connects via built-in Auth Proxy (Unix socket volume mount)

Accounts Cloud Run (cloud-run-accounts.tf):
- 3 regions (us-central1, europe-west1, asia-northeast1), min:1 max:50
- Cloud SQL proxy volume mount; secrets via Secret Manager
- Stripe + JWT env vars; health probe on /health

API Cloud Run (cloud-run-api.tf):
- 3 regions, min:1 max:100, cpu_idle=false (always-hot)
- Validates JWTs from accounts service; no direct DB connection
- License admin token from Secret Manager

Load balancer (host-based routing):
- Same global anycast IP for all three services
- URL map routes by Host: neurontechnologies.ai→marketing,
  api.neurontechnologies.ai→api, accounts.neurontechnologies.ai→accounts
- New managed SSL certs for api.* and accounts.* added to HTTPS proxy
- Cloud Armor (WAF + rate limit) applied to all backends

Service accounts + IAM:
- neuron-accounts-sa: secretmanager.secretAccessor + cloudsql.client
- neuron-api-sa: secretmanager.secretAccessor
- allUsers invoker on all prod Cloud Run services (LB health checks)

bootstrap.sh:
- One-shot setup: pulls Stripe secrets from Vault → Secret Manager,
  creates CI SA JSON key, prints DNS + next-step instructions

servers/gcp/load-balancer.tf

@@ -223,21 +223,59 @@ resource "google_compute_managed_ssl_certificate" "stage" {
   }
 }
 
-# ── Prod URL Map ──────────────────────────────────────────────────────────────
+# ── Prod URL Map — host-based routing ────────────────────────────────────────
+# One global IP handles all three services via Host header routing.
+# - neurontechnologies.ai / www.  → marketing (default)
+# - api.neurontechnologies.ai     → API backend
+# - accounts.neurontechnologies.ai → accounts backend
 
 resource "google_compute_url_map" "prod" {
   name            = "marketing-urlmap-prod"
   project         = var.project_id
   default_service = google_compute_backend_service.prod.self_link
+
+  host_rule {
+    hosts        = ["neurontechnologies.ai", "www.neurontechnologies.ai"]
+    path_matcher = "marketing"
+  }
+
+  host_rule {
+    hosts        = ["api.neurontechnologies.ai"]
+    path_matcher = "api"
+  }
+
+  host_rule {
+    hosts        = ["accounts.neurontechnologies.ai"]
+    path_matcher = "accounts"
+  }
+
+  path_matcher {
+    name            = "marketing"
+    default_service = google_compute_backend_service.prod.self_link
+  }
+
+  path_matcher {
+    name            = "api"
+    default_service = google_compute_backend_service.api.self_link
+  }
+
+  path_matcher {
+    name            = "accounts"
+    default_service = google_compute_backend_service.accounts.self_link
+  }
 }
 
 # ── Prod HTTPS Target Proxy ───────────────────────────────────────────────────
 
 resource "google_compute_target_https_proxy" "prod" {
-  name             = "marketing-https-proxy-prod"
-  project          = var.project_id
-  url_map          = google_compute_url_map.prod.self_link
-  ssl_certificates = [google_compute_managed_ssl_certificate.prod.self_link]
+  name    = "marketing-https-proxy-prod"
+  project = var.project_id
+  url_map = google_compute_url_map.prod.self_link
+  ssl_certificates = [
+    google_compute_managed_ssl_certificate.prod.self_link,
+    google_compute_managed_ssl_certificate.accounts.self_link,
+    google_compute_managed_ssl_certificate.api.self_link,
+  ]
 }
 
 # ── Prod HTTP → HTTPS redirect ────────────────────────────────────────────────