fix(redpanda): remove unsupported --set flags, add external listener on 9093

Newer Redpanda versions removed --set CLI flags. Also adds dual listener:
- INTERNAL://9092 for in-cluster services (ClusterIP)
- EXTERNAL://9093 for Tailscale access from Mac (NodePort 30093 → 100.64.0.1:30093)

servers/legion/k8s/redpanda/deployment.yaml

@@ -27,15 +27,15 @@ spec:
             - --memory=512M
             - --reserve-memory=0M
             - --overprovisioned
-            - --kafka-addr=PLAINTEXT://0.0.0.0:9092
-            - --advertise-kafka-addr=PLAINTEXT://redpanda.platform.svc.cluster.local:9092
+            - --kafka-addr=INTERNAL://0.0.0.0:9092,EXTERNAL://0.0.0.0:9093
+            - --advertise-kafka-addr=INTERNAL://redpanda.platform.svc.cluster.local:9092,EXTERNAL://100.64.0.1:30093
             - --pandaproxy-addr=0.0.0.0:8082
             - --advertise-pandaproxy-addr=redpanda.platform.svc.cluster.local:8082
-            - --set=redpanda.enable_transactions=true
-            - --set=redpanda.enable_idempotence=true
           ports:
-            - name: kafka
+            - name: kafka-internal
               containerPort: 9092
+            - name: kafka-external
+              containerPort: 9093
             - name: admin
               containerPort: 9644
             - name: proxy
@@ -60,6 +60,7 @@ spec:
           persistentVolumeClaim:
             claimName: redpanda-data
 ---
+# Internal ClusterIP — for in-cluster services (coordinator, CI jobs)
 apiVersion: v1
 kind: Service
 metadata:
@@ -80,6 +81,22 @@ spec:
       targetPort: 8082
   type: ClusterIP
 ---
+# NodePort — for external access via Tailscale (100.64.0.1:30093)
+apiVersion: v1
+kind: Service
+metadata:
+  name: redpanda-external
+  namespace: platform
+spec:
+  selector:
+    app: redpanda
+  ports:
+    - name: kafka-external
+      port: 9093
+      targetPort: 9093
+      nodePort: 30093
+  type: NodePort
+---
 apiVersion: apps/v1
 kind: Deployment
 metadata: