fix: gateway authentik port + encrypt sensitive infrastructure details

Security improvements:
- Fix gateway→authentik port from 80 to 9000 (matches NetworkPolicy)
- Encrypt gateway ConfigMap (contains internal cluster DNS names)
- Encrypt gateway-config-secret with SOPS using AGE encryption
- Add .sops.yaml configuration for future secret management

Files encrypted with AGE key:
- k8s/configmap.yaml (ConfigMap → encrypted)
- k8s/gateway-config-secret.enc.yaml (Secret → encrypted)

Internal infrastructure details now protected:
✓ Service DNS names (.svc.cluster.local)
✓ Upstream URLs
✓ Auth endpoints
✓ Port configurations

Fixes JWT validation failures and 401 errors on LLM requests.
Reduces attack surface by protecting infrastructure topology.

.sops.yaml

@@ -0,0 +1,4 @@
+creation_rules:
+  # Encrypt secrets, configs, and deployment files with infrastructure details
+  - path_regex: k8s/(.*secret.*|.*config.*|.*deployment.*\.ya?ml)
+    age: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla