Deploy soma to GCP Cloud Run at ai.neurontechnologies.ai

- Add cloud-run-soma.tf: soma-prod-us Cloud Run service in us-central1,
  neuron-soma-sa service account, soma Artifact Registry repo, Secret
  Manager secrets for HF token and operator key, serverless NEG, backend
  service, SSL cert
- Add dns-gcp.tf: Cloudflare A record for ai.neurontechnologies.ai pointing
  to GCP LB IP; Cloudflare provider added to main.tf/variables.tf
- Update load-balancer.tf: soma host rule + path matcher, soma SSL cert
  added to HTTPS proxy
- Update outputs.tf: soma service URL and artifact registry URL outputs
- Remove legion soma k8s manifests (Legion is gone)
- Update AGENTS.md to reflect GCP as primary production environment

servers/gcp/dns-gcp.tf

@@ -0,0 +1,17 @@
+# ── Cloudflare DNS — GCP-backed services ─────────────────────────────────────
+# A records pointing to the GCP global load balancer IP.
+# All subdomains share the same anycast IP (google_compute_global_address.prod).
+#
+# Cloudflare provider reads CLOUDFLARE_API_TOKEN from env.
+# Zone ID for neurontechnologies.ai is set in terraform.tfvars.
+
+# ── ai.neurontechnologies.ai → Soma inference gateway ────────────────────────
+
+resource "cloudflare_record" "soma_ai" {
+  zone_id = var.cloudflare_zone_id_neurontechnologies
+  name    = "ai"
+  type    = "A"
+  content = google_compute_global_address.prod.address
+  proxied = true
+  ttl     = 1
+}