Expand GCP infra: accounts + API services, Cloud SQL, Artifact Registry

Architecture: intelligence stays on Legion; only compiled artifacts cross
to GCP. Source code and Neuron's knowledge base never leave the system.

Artifact Registry:
- neuron-marketing, neuron-accounts, neuron-api repos in us-central1
- Keep-last-10 cleanup policy; ci-pusher SA with writer access
- Legion CI runners authenticate via GCP_SA_KEY Gitea secret

Cloud SQL (cloud-sql.tf):
- postgres-15 on db-g1-small, us-central1 (scale up to REGIONAL HA at 1k users)
- Point-in-time recovery, 14-day backup retention
- Accounts DB + user; password generated and stored in Secret Manager
- JWT signing key in Secret Manager (shared by accounts + api)
- Cloud Run connects via built-in Auth Proxy (Unix socket volume mount)

Accounts Cloud Run (cloud-run-accounts.tf):
- 3 regions (us-central1, europe-west1, asia-northeast1), min:1 max:50
- Cloud SQL proxy volume mount; secrets via Secret Manager
- Stripe + JWT env vars; health probe on /health

API Cloud Run (cloud-run-api.tf):
- 3 regions, min:1 max:100, cpu_idle=false (always-hot)
- Validates JWTs from accounts service; no direct DB connection
- License admin token from Secret Manager

Load balancer (host-based routing):
- Same global anycast IP for all three services
- URL map routes by Host: neurontechnologies.ai→marketing,
  api.neurontechnologies.ai→api, accounts.neurontechnologies.ai→accounts
- New managed SSL certs for api.* and accounts.* added to HTTPS proxy
- Cloud Armor (WAF + rate limit) applied to all backends

Service accounts + IAM:
- neuron-accounts-sa: secretmanager.secretAccessor + cloudsql.client
- neuron-api-sa: secretmanager.secretAccessor
- allUsers invoker on all prod Cloud Run services (LB health checks)

bootstrap.sh:
- One-shot setup: pulls Stripe secrets from Vault → Secret Manager,
  creates CI SA JSON key, prints DNS + next-step instructions

servers/gcp/variables.tf

@@ -5,7 +5,19 @@ variable "project_id" {
 }
 
 variable "image_tag" {
-  description = "Docker image tag to deploy"
+  description = "Docker image tag to deploy for the marketing site"
+  type        = string
+  default     = "latest"
+}
+
+variable "accounts_image_tag" {
+  description = "Docker image tag to deploy for the accounts service"
+  type        = string
+  default     = "latest"
+}
+
+variable "api_image_tag" {
+  description = "Docker image tag to deploy for the REST API (neuron-rest)"
   type        = string
   default     = "latest"
 }
@@ -20,23 +32,14 @@ variable "cloudflare_zone_id_neurontechnologies" {
 
 locals {
   project_id = var.project_id
-  image      = "us-central1-docker.pkg.dev/${var.project_id}/neuron-marketing/marketing:${var.image_tag}"
 
-  # Production secrets from GCP Secret Manager
-  secrets = [
-    "stripe-secret-key",
-    "stripe-webhook-secret",
-    "stripe-price-professional",
-    "stripe-price-founding",
-  ]
+  # Image refs per service
+  marketing_image = "us-central1-docker.pkg.dev/${var.project_id}/neuron-marketing/marketing:${var.image_tag}"
+  accounts_image  = "us-central1-docker.pkg.dev/${var.project_id}/neuron-accounts/accounts:${var.accounts_image_tag}"
+  api_image       = "us-central1-docker.pkg.dev/${var.project_id}/neuron-api/api:${var.api_image_tag}"
 
-  # Env var names for each secret (uppercase, hyphen → underscore)
-  secret_env_map = {
-    "stripe-secret-key"        = "STRIPE_SECRET_KEY"
-    "stripe-webhook-secret"    = "STRIPE_WEBHOOK_SECRET"
-    "stripe-price-professional" = "STRIPE_PRICE_PROFESSIONAL"
-    "stripe-price-founding"    = "STRIPE_PRICE_FOUNDING"
-  }
+  # Keep backward-compat alias (used in cloud-run.tf for marketing service)
+  image = local.marketing_image
 
   # Static publishable key (not sensitive — lives in source)
   stripe_publishable_key = "pk_live_51TPoHnJg9Fv1D3AUPMXnYyOJIVhn1FyH56zCMNnATo9tR7pO9lNDbXncp6VeDxm38qSdBHZPfqEBipUh3GZsWNyd00jvIO97E6"