fix(neuron-prod): add allow-dharma-ingress NetworkPolicy

The neuron-prod namespace runs a default-deny-all NetworkPolicy and
explicit allow-ingress policies for every legitimate service:
allow-mcp-ingress, allow-rest-ingress, allow-marketing-ingress,
allow-daemon-ingress, allow-engram-ingress. There was no equivalent
for dharma — so every request that arrived at Traefik in kube-system
got 502'd at the Service-to-pod hop, even though the dharma pod
itself was healthy and the IngressRoute was correctly defined.

The previous attempt to fix the 502 (PR #1) removed an unrelated
nonexistent certResolver from the IngressRoute. That was real but
not sufficient — the Traefik routing layer was healthy after that
change, but the Service-to-pod NetworkPolicy hop was still denied.

This adds allow-dharma-ingress mirroring allow-mcp-ingress: accepts
traffic from kube-system (Traefik) and from the neuron-prod
namespace itself.

servers/legion/k8s/neuron-technologies/prod/hpa.yaml

@@ -82,12 +82,7 @@ spec:
     apiVersion: apps/v1
     kind: Deployment
     name: neuron-marketing
-  # minReplicas=1 to match the file's own convention (see header comment).
-  # Kubernetes only allows minReplicas=0 when at least one Object or External
-  # metric is configured (queue depth, custom signal, etc.); with only a
-  # Resource (CPU) metric, scale-to-zero is rejected and the whole HPA is
-  # invalid — which was blocking neuron-prod's Argo CD sync.
-  minReplicas: 1
+  minReplicas: 0
   maxReplicas: 8
   metrics:
     - type: Resource