chore: initial commit of Go API gateway

Baseline for the Kong replacement on api.riotpiao.com. Brings the working
tree under version control for the first time: gateway source, the task
board that drives the agent runs, test fixtures, and K8s manifests.

Anchor the gateway ignore rule to the repo root. Unanchored, "gateway"
also matched the cmd/gateway/ source directory, so the program entrypoint
was excluded from every commit.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

tasks/1.6-websocket-upgrade.md

@@ -0,0 +1,27 @@
+# 1.6 — WebSocket upgrade (GREEN)
+
+Phase: 1 — Proxy core
+Stage: GREEN
+Depends on: [1.5](1.5-header-hygiene.md)
+
+- [ ] A route may be configured to allow protocol upgrade
+- [ ] An upgrade request on such a route reaches the upstream with its `Upgrade` and `Connection` headers intact, despite hop-by-hop stripping
+- [ ] The upstream's `101 Switching Protocols` response reaches the client, and bytes then flow bidirectionally
+- [ ] Frames pass in both directions with no buffering delay
+- [ ] Client close propagates to the upstream and upstream close propagates to the client
+- [ ] An upgrade attempt on a route that does not allow it is rejected, not silently downgraded to a plain proxied request
+- [ ] Idle upgraded connections are not cut by the route's read timeout while frames are still flowing
+
+`agent-pod/console` serves a WebSocket and is one of the seven Kong-class Ingresses
+being migrated. It is currently publicly routed and unauthenticated into a
+shell-capable container, so it must work through the gateway before it can be put
+behind gateway auth. Header hygiene and upgrade support interact directly: `Upgrade`
+and `Connection` are hop-by-hop, and a naive strip breaks the handshake.
+
+## Verify
+
+```bash
+go test ./internal/proxy/... -run TestWebSocketUpgrade -v
+# expected: passes — client receives 101 from the stub, an echoed frame round-trips in
+# both directions, and closing the client causes the stub to observe a close
+```