chore: initial commit of Go API gateway

Baseline for the Kong replacement on api.riotpiao.com. Brings the working
tree under version control for the first time: gateway source, the task
board that drives the agent runs, test fixtures, and K8s manifests.

Anchor the gateway ignore rule to the repo root. Unanchored, "gateway"
also matched the cmd/gateway/ source directory, so the program entrypoint
was excluded from every commit.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

testdata/config/duplicate-routes.yaml

@@ -0,0 +1,17 @@
+routes:
+  - name: test-route
+    upstream:
+      address: host1.llm-serving:80
+      connectTimeout: "30s"
+      readTimeout: "5m"
+      writeTimeout: "1m"
+      maxBodySize: 10485760
+      authRequired: true
+  - name: test-route
+    upstream:
+      address: host2.llm-serving:80
+      connectTimeout: "30s"
+      readTimeout: "5m"
+      writeTimeout: "1m"
+      maxBodySize: 20971520
+      authRequired: false

testdata/config/harness.yaml

@@ -0,0 +1,31 @@
+# Local development harness config. Every upstream points at the single stub
+# server started by internal/testsupport, on loopback only — no cluster address,
+# no *.riotpiao.com, no credentials. Route names match testdata/config/valid.yaml
+# so the same assertions work against either fixture.
+routes:
+  - name: reasoning-chat
+    upstream:
+      address: 127.0.0.1:9080
+      connectTimeout: "10s"
+      readTimeout: "1h"
+      writeTimeout: "1h"
+      maxBodySize: 10485760
+      authRequired: false
+
+  - name: ornith-chat
+    upstream:
+      address: 127.0.0.1:9080
+      connectTimeout: "5s"
+      readTimeout: "10m"
+      writeTimeout: "3m"
+      maxBodySize: 5242880
+      authRequired: false
+
+  - name: embeddings
+    upstream:
+      address: 127.0.0.1:9080
+      connectTimeout: "5s"
+      readTimeout: "30m"
+      writeTimeout: "2m"
+      maxBodySize: 5242880
+      authRequired: false

testdata/config/invalid-address-no-port.yaml

@@ -0,0 +1,9 @@
+routes:
+  - name: test-route
+    upstream:
+      address: localhost
+      connectTimeout: "30s"
+      readTimeout: "5m"
+      writeTimeout: "1m"
+      maxBodySize: 10485760
+      authRequired: true

testdata/config/malformed-connectTimeout.yaml

@@ -0,0 +1,9 @@
+routes:
+  - name: test-route
+    upstream:
+      address: test-host.llm-serving:80
+      connectTimeout: "not-a-duration"
+      readTimeout: "5m"
+      writeTimeout: "1m"
+      maxBodySize: 10485760
+      authRequired: true

testdata/config/malformed-readTimeout.yaml

@@ -0,0 +1,9 @@
+routes:
+  - name: test-route
+    upstream:
+      address: test-host.llm-serving:80
+      connectTimeout: "30s"
+      readTimeout: "invalid"
+      writeTimeout: "1m"
+      maxBodySize: 10485760
+      authRequired: true

testdata/config/malformed-writeTimeout.yaml

@@ -0,0 +1,9 @@
+routes:
+  - name: test-route
+    upstream:
+      address: test-host.llm-serving:80
+      connectTimeout: "30s"
+      readTimeout: "5m"
+      writeTimeout: "bad"
+      maxBodySize: 10485760
+      authRequired: true

testdata/config/missing-address.yaml

@@ -0,0 +1,8 @@
+routes:
+  - name: test-route
+    upstream:
+      connectTimeout: "30s"
+      readTimeout: "5m"
+      writeTimeout: "1m"
+      maxBodySize: 10485760
+      authRequired: true

testdata/config/missing-authRequired.yaml

@@ -0,0 +1,8 @@
+routes:
+  - name: test-route
+    upstream:
+      address: test-host.llm-serving:80
+      connectTimeout: "30s"
+      readTimeout: "5m"
+      writeTimeout: "1m"
+      maxBodySize: 10485760

testdata/config/missing-connectTimeout.yaml

@@ -0,0 +1,8 @@
+routes:
+  - name: test-route
+    upstream:
+      address: test-host.llm-serving:80
+      readTimeout: "5m"
+      writeTimeout: "1m"
+      maxBodySize: 10485760
+      authRequired: true

testdata/config/missing-maxBodySize.yaml

@@ -0,0 +1,8 @@
+routes:
+  - name: test-route
+    upstream:
+      address: test-host.llm-serving:80
+      connectTimeout: "30s"
+      readTimeout: "5m"
+      writeTimeout: "1m"
+      authRequired: true

testdata/config/missing-readTimeout.yaml

@@ -0,0 +1,8 @@
+routes:
+  - name: test-route
+    upstream:
+      address: test-host.llm-serving:80
+      connectTimeout: "30s"
+      writeTimeout: "1m"
+      maxBodySize: 10485760
+      authRequired: true

testdata/config/missing-writeTimeout.yaml

@@ -0,0 +1,8 @@
+routes:
+  - name: test-route
+    upstream:
+      address: test-host.llm-serving:80
+      connectTimeout: "30s"
+      readTimeout: "5m"
+      maxBodySize: 10485760
+      authRequired: true

testdata/config/valid.yaml

@@ -0,0 +1,27 @@
+routes:
+  - name: reasoning-chat
+    upstream:
+      address: reasoning-predictor.llm-serving:80
+      connectTimeout: "10s"
+      readTimeout: "1h"
+      writeTimeout: "1h"
+      maxBodySize: 10485760
+      authRequired: true
+
+  - name: ornith-chat
+    upstream:
+      address: ornith-frontend.llm-serving:80
+      connectTimeout: "5s"
+      readTimeout: "10m"
+      writeTimeout: "3m"
+      maxBodySize: 5242880
+      authRequired: false
+
+  - name: embeddings
+    upstream:
+      address: embedding-worker.llm-serving:80
+      connectTimeout: "5s"
+      readTimeout: "30m"
+      writeTimeout: "2m"
+      maxBodySize: 5242880
+      authRequired: true