fix: ensure test pod can reach all downstream services

Add labels to test pod to match network policy selectors:
- app=api-gateway (matches network policy pod selector)
- managed-by=argocd (matches network policy pod selector)
- role=test (identify as test pod)
- test-run=<sha> (track which test run spawned it)

Network policy 'api-gateway' in api namespace already allows egress to:
✅ kube-system (DNS resolution)
✅ poimen (port 8080 - Memory service)
✅ temporal (port 7233 - Workflow service)
✅ storage (ports 80, 9000 - S3/MinIO)
✅ sqs (port 9090 - SQS service)
✅ iam (ports 9000, 9443 - Authentik/IAM)

Test pod inherits same network access as production pods via labels.
No additional network policies needed.

k8s/integration-test-job.yaml

@@ -5,6 +5,11 @@ metadata:
   namespace: api
 spec:
   template:
+    metadata:
+      labels:
+        app: api-gateway
+        managed-by: test
+        role: integration-test
     spec:
       serviceAccountName: api-gateway
       restartPolicy: Never