Expand GCP infra: accounts + API services, Cloud SQL, Artifact Registry

Architecture: intelligence stays on Legion; only compiled artifacts cross
to GCP. Source code and Neuron's knowledge base never leave the system.

Artifact Registry:
- neuron-marketing, neuron-accounts, neuron-api repos in us-central1
- Keep-last-10 cleanup policy; ci-pusher SA with writer access
- Legion CI runners authenticate via GCP_SA_KEY Gitea secret

Cloud SQL (cloud-sql.tf):
- postgres-15 on db-g1-small, us-central1 (scale up to REGIONAL HA at 1k users)
- Point-in-time recovery, 14-day backup retention
- Accounts DB + user; password generated and stored in Secret Manager
- JWT signing key in Secret Manager (shared by accounts + api)
- Cloud Run connects via built-in Auth Proxy (Unix socket volume mount)

Accounts Cloud Run (cloud-run-accounts.tf):
- 3 regions (us-central1, europe-west1, asia-northeast1), min:1 max:50
- Cloud SQL proxy volume mount; secrets via Secret Manager
- Stripe + JWT env vars; health probe on /health

API Cloud Run (cloud-run-api.tf):
- 3 regions, min:1 max:100, cpu_idle=false (always-hot)
- Validates JWTs from accounts service; no direct DB connection
- License admin token from Secret Manager

Load balancer (host-based routing):
- Same global anycast IP for all three services
- URL map routes by Host: neurontechnologies.ai→marketing,
  api.neurontechnologies.ai→api, accounts.neurontechnologies.ai→accounts
- New managed SSL certs for api.* and accounts.* added to HTTPS proxy
- Cloud Armor (WAF + rate limit) applied to all backends

Service accounts + IAM:
- neuron-accounts-sa: secretmanager.secretAccessor + cloudsql.client
- neuron-api-sa: secretmanager.secretAccessor
- allUsers invoker on all prod Cloud Run services (LB health checks)

bootstrap.sh:
- One-shot setup: pulls Stripe secrets from Vault → Secret Manager,
  creates CI SA JSON key, prints DNS + next-step instructions

servers/gcp/outputs.tf

@@ -1,44 +1,96 @@
 # ── Outputs ───────────────────────────────────────────────────────────────────
-# After `terraform apply`, use these IPs to update Cloudflare DNS A records.
+# After `terraform apply`, use prod_lb_ip for Cloudflare DNS A records.
 #
-# Prod:  neurontechnologies.ai + www.neurontechnologies.ai → prod_lb_ip
-# Stage: stage.neurontechnologies.ai                       → stage_lb_ip
+# All three services share the same global anycast IP (prod_lb_ip).
+# Set these A records in Cloudflare (proxied=true for CDN + DDoS):
+#   neurontechnologies.ai       → prod_lb_ip
+#   www.neurontechnologies.ai   → prod_lb_ip
+#   api.neurontechnologies.ai   → prod_lb_ip
+#   accounts.neurontechnologies.ai → prod_lb_ip
 #
-# In the Legion Terraform (dns-neurontechnologies.tf), replace the tunnel CNAMEs
-# for neurontechnologies.ai, www, and stage with A records pointing to these IPs.
-# Set proxied=true in Cloudflare to keep CDN/DDoS protection layered in front.
+# Stage: stage.neurontechnologies.ai → stage_lb_ip (separate IP)
 
 output "prod_lb_ip" {
-  description = "Global anycast IP for the production load balancer (neurontechnologies.ai + www)"
+  description = "Global anycast IP for all prod services (marketing, accounts, api)"
   value       = google_compute_global_address.prod.address
 }
 
 output "stage_lb_ip" {
-  description = "Global anycast IP for the staging load balancer (stage.neurontechnologies.ai)"
+  description = "Global anycast IP for the staging load balancer"
   value       = google_compute_global_address.stage.address
 }
 
 output "prod_ssl_cert_name" {
-  description = "Name of the Google-managed SSL cert for prod (check provisioning status in GCP console)"
+  description = "Marketing SSL cert (check provisioning status in GCP console)"
   value       = google_compute_managed_ssl_certificate.prod.name
 }
 
+output "accounts_ssl_cert_name" {
+  description = "Accounts SSL cert (check provisioning status in GCP console)"
+  value       = google_compute_managed_ssl_certificate.accounts.name
+}
+
+output "api_ssl_cert_name" {
+  description = "API SSL cert (check provisioning status in GCP console)"
+  value       = google_compute_managed_ssl_certificate.api.name
+}
+
 output "stage_ssl_cert_name" {
-  description = "Name of the Google-managed SSL cert for stage"
+  description = "Stage SSL cert"
   value       = google_compute_managed_ssl_certificate.stage.name
 }
 
 output "marketing_service_account_email" {
-  description = "Service account email for Cloud Run services"
+  description = "Marketing Cloud Run SA"
   value       = google_service_account.marketing.email
 }
 
+output "accounts_service_account_email" {
+  description = "Accounts Cloud Run SA"
+  value       = google_service_account.accounts.email
+}
+
+output "api_service_account_email" {
+  description = "API Cloud Run SA"
+  value       = google_service_account.api.email
+}
+
+output "ci_pusher_email" {
+  description = "CI SA email — use to create the JSON key for GCP_SA_KEY Gitea secret"
+  value       = google_service_account.ci_pusher.email
+}
+
+output "cloud_sql_connection_name" {
+  description = "Cloud SQL instance connection name — use in Cloud Run volume mounts"
+  value       = google_sql_database_instance.main.connection_name
+}
+
+output "cloud_sql_instance_ip" {
+  description = "Cloud SQL public IP (for bastion/migration access — disable when not needed)"
+  value       = google_sql_database_instance.main.public_ip_address
+}
+
 output "cloud_run_services" {
-  description = "Cloud Run service URLs per region"
+  description = "Cloud Run service URLs per service and region"
   value = {
-    prod_us   = google_cloud_run_v2_service.prod_us.uri
-    prod_eu   = google_cloud_run_v2_service.prod_eu.uri
-    prod_apac = google_cloud_run_v2_service.prod_apac.uri
-    stage     = google_cloud_run_v2_service.stage.uri
+    marketing_us   = google_cloud_run_v2_service.prod_us.uri
+    marketing_eu   = google_cloud_run_v2_service.prod_eu.uri
+    marketing_apac = google_cloud_run_v2_service.prod_apac.uri
+    marketing_stage = google_cloud_run_v2_service.stage.uri
+    accounts_us    = google_cloud_run_v2_service.accounts_us.uri
+    accounts_eu    = google_cloud_run_v2_service.accounts_eu.uri
+    accounts_apac  = google_cloud_run_v2_service.accounts_apac.uri
+    api_us         = google_cloud_run_v2_service.api_us.uri
+    api_eu         = google_cloud_run_v2_service.api_eu.uri
+    api_apac       = google_cloud_run_v2_service.api_apac.uri
+  }
+}
+
+output "artifact_registry_urls" {
+  description = "Docker image base URLs for each service"
+  value = {
+    marketing = "us-central1-docker.pkg.dev/${var.project_id}/neuron-marketing/marketing"
+    accounts  = "us-central1-docker.pkg.dev/${var.project_id}/neuron-accounts/accounts"
+    api       = "us-central1-docker.pkg.dev/${var.project_id}/neuron-api/api"
   }
 }