Split-horizon breaks VPN/LAN hybrid scenarios. Let all clients use
public DNS (Cloudflare proxy IPs) and route via CF tunnel. Works
everywhere, no network-topology-dependent DNS required.
LAN IP 192.168.68.77 unreachable over Tailscale VPN. 100.64.0.1 works
for both LAN (Tailscale installed) and remote VPN clients. Also adds
*.neuralplatform.dev which was missing from the configmap.
PVC manifests: add volumeName to bind new PVCs to existing PVs whose
old PVCs were accidentally deleted during Terraform->ArgoCD migration.
All PVs patched to Retain to prevent data loss on pod restart.
kube-prometheus-stack: replace invalid adminPassword.valueFrom.secretKeyRef
(Helm values don't support k8s secretKeyRef syntax) with correct
admin.existingSecret + admin.passwordKey pattern.
Will Anderson