Deploy soma to GCP Cloud Run at ai.neurontechnologies.ai

- Add cloud-run-soma.tf: soma-prod-us Cloud Run service in us-central1,
  neuron-soma-sa service account, soma Artifact Registry repo, Secret
  Manager secrets for HF token and operator key, serverless NEG, backend
  service, SSL cert
- Add dns-gcp.tf: Cloudflare A record for ai.neurontechnologies.ai pointing
  to GCP LB IP; Cloudflare provider added to main.tf/variables.tf
- Update load-balancer.tf: soma host rule + path matcher, soma SSL cert
  added to HTTPS proxy
- Update outputs.tf: soma service URL and artifact registry URL outputs
- Remove legion soma k8s manifests (Legion is gone)
- Update AGENTS.md to reflect GCP as primary production environment

servers/gcp/load-balancer.tf

@@ -205,6 +205,11 @@ resource "google_compute_url_map" "prod" {
     path_matcher = "accounts"
   }
 
+  host_rule {
+    hosts        = ["ai.neurontechnologies.ai"]
+    path_matcher = "soma"
+  }
+
   path_matcher {
     name            = "marketing"
     default_service = google_compute_backend_service.prod.self_link
@@ -219,6 +224,11 @@ resource "google_compute_url_map" "prod" {
     name            = "accounts"
     default_service = google_compute_backend_service.accounts.self_link
   }
+
+  path_matcher {
+    name            = "soma"
+    default_service = google_compute_backend_service.soma.self_link
+  }
 }
 
 # ── Prod HTTPS Target Proxy ───────────────────────────────────────────────────
@@ -231,6 +241,7 @@ resource "google_compute_target_https_proxy" "prod" {
     google_compute_managed_ssl_certificate.prod.self_link,
     google_compute_managed_ssl_certificate.accounts.self_link,
     google_compute_managed_ssl_certificate.api.self_link,
+    google_compute_managed_ssl_certificate.soma.self_link,
   ]
 }