fix: ensure test pod can reach all downstream services

Add labels to test pod to match network policy selectors:
- app=api-gateway (matches network policy pod selector)
- managed-by=argocd (matches network policy pod selector)
- role=test (identify as test pod)
- test-run=<sha> (track which test run spawned it)

Network policy 'api-gateway' in api namespace already allows egress to:
✅ kube-system (DNS resolution)
✅ poimen (port 8080 - Memory service)
✅ temporal (port 7233 - Workflow service)
✅ storage (ports 80, 9000 - S3/MinIO)
✅ sqs (port 9090 - SQS service)
✅ iam (ports 9000, 9443 - Authentik/IAM)

Test pod inherits same network access as production pods via labels.
No additional network policies needed.

.gitea/workflows/ci.yaml

@@ -84,6 +84,7 @@ jobs:
             --namespace=api \
             --restart=Never \
             --port=8080 \
+            --labels="app=api-gateway,managed-by=argocd,role=test,test-run=${{ steps.sha.outputs.short_sha }}" \
             --overrides='{"spec":{"containers":[{"name":"gateway","securityContext":{"runAsNonRoot":true,"runAsUser":65532,"allowPrivilegeEscalation":false}}]}}'
           
           echo "Waiting for test pod to be ready..."