fix(agent-pod): pin api.riotpiao.com via hostAliases

api.riotpiao.com has no in-cluster DNS record (getaddrinfo ENOTFOUND
from inside the pod, confirmed against google.com resolving fine and
kong-proxy.api.svc.cluster.local resolving fine) -- it only resolves
via the home network's own DNS. Node's fetch/undici also silently
drops a manually-set Host header (forbidden header per WHATWG fetch
spec), so overriding Host per-request isn't viable either. hostAliases
pinning the hostname to ingress-nginx-controller's ClusterIP lets
pi's models.json baseUrl work completely unchanged -- TLS SNI/Host
still say api.riotpiao.com so cert validation and Kong's Host-based
routing both still work.

k8s/apps/agent-pod/deployment.yaml

@@ -13,6 +13,14 @@ spec:
       labels:
         app: agent-pod
     spec:
+      # api.riotpiao.com has no in-cluster DNS record (only resolves from the
+      # home network's own resolver) -- pin it to ingress-nginx-controller's
+      # ClusterIP so pi's models.json baseUrl works unchanged. TLS still
+      # terminates correctly since SNI/Host still say api.riotpiao.com.
+      hostAliases:
+        - ip: "10.101.128.185"
+          hostnames:
+            - "api.riotpiao.com"
       containers:
         - name: pi
           image: node:22-slim