fix(llm-serving): restrict ingress to api-gateway and monitoring

Replace hand-applied llm-serving-default-deny NetworkPolicy that used
llm-client=true pod label selector (any pod in any namespace could
self-grant access) with a proper namespace-scoped policy.

Ingress now restricted to:
- api namespace (gateway) on ports 8080/80/8000/11434
- monitoring namespace (Prometheus) on ports 8080/9000
- intra-namespace (pod-to-pod within llm-serving)

Tested live:
- Gateway -> reasoning/ornith/embeddings/reranker: 200 OK
- default namespace -> llm-serving: timeout (blocked)
- portfolio namespace -> llm-serving: timeout (blocked)

Closes #13

k8s/apps/llm-serving/kustomization.yaml

@@ -14,5 +14,6 @@ resources:
   - ornith.yaml
   - reasoning.yaml
   - reranker.yaml
+  - networkpolicy.yaml
 # No namespace transformer: every file sets its own, and the transformer would
 # rewrite metadata.namespace on anything cross-namespace added later.